CVE-2008-1304
WordPress 2.3.2 - Cross-Site Scripting via Invite Email and To Parameters
Title source: llmExploitation Summary
EIP tracks 2 public exploits for CVE-2008-1304. PoCs published by Doz.
AI-analyzed exploit summary This exploit demonstrates a cross-site scripting (XSS) vulnerability in WordPress 2.3.2 by injecting an iframe via the 'inviteemail' parameter in the users.php admin page. The payload steals cookie-based authentication credentials by redirecting to a malicious URL.
Description
Multiple cross-site scripting (XSS) vulnerabilities in WordPress 2.3.2 allow remote attackers to inject arbitrary web script or HTML via the (1) inviteemail parameter in an invite action to wp-admin/users.php and the (2) to parameter in a sent action to wp-admin/invites.php.
Exploits (2)
This exploit demonstrates a cross-site scripting (XSS) vulnerability in WordPress 2.3.2 by injecting an iframe via the 'inviteemail' parameter in the users.php admin page. The payload steals cookie-based authentication credentials by redirecting to a malicious URL.
This exploit demonstrates a cross-site scripting (XSS) vulnerability in WordPress 2.3.2 by injecting a malicious script via the 'to' parameter in the invites.php page. The PoC uses a simple alert script to prove the vulnerability.