CVE-2008-1385

Serendipity < 1.3.1 - Cross-Site Scripting via Referer HTTP Header

Title source: llm

Exploitation Summary

EIP tracks 1 public exploit for CVE-2008-1385. PoCs published by Hanno Boeck.

AI-analyzed exploit summary This exploit demonstrates an HTML injection and XSS vulnerability in S9Y Serendipity 1.3 by injecting malicious JavaScript via the HTTP referrer header. The PoC uses wget to send a crafted referrer header containing an onMouseOver event to trigger an alert.

Description

Cross-site scripting (XSS) vulnerability in the Top Referrers (aka referrer) plugin in Serendipity (S9Y) before 1.3.1 allows remote attackers to inject arbitrary web script or HTML via the Referer HTTP header.

Exploits (1)

exploitdb WORKING POC VERIFIED

by Hanno Boeck · textwebappsphp

https://www.exploit-db.com/exploits/31682

View Code ZIP pw:eip

This exploit demonstrates an HTML injection and XSS vulnerability in S9Y Serendipity 1.3 by injecting malicious JavaScript via the HTTP referrer header. The PoC uses wget to send a crafted referrer header containing an onMouseOver event to trigger an alert.

Classification

Working Poc 90%

Attack Type

Xss

Complexity

Trivial

Reliability

Reliable

Target: S9Y Serendipity 1.3

No auth needed

Prerequisites: Access to a tool like wget or curl to send crafted HTTP requests

MITRE ATT&CK