CVE-2008-2646

meBiblio 0.4.7 - Cross-Site Scripting via SQL Parameter

Title source: llm
STIX 2.1

Exploitation Summary

EIP tracks 1 public exploit for CVE-2008-2646. PoCs published by CWH Underground.

AI-analyzed exploit summary The exploit demonstrates SQL injection, arbitrary file upload, and XSS vulnerabilities in meBiblio 0.4.7. It includes specific URLs and parameters for exploitation, confirming functional PoC details.

Description

Multiple cross-site scripting (XSS) vulnerabilities in meBiblio 0.4.7 allow remote attackers to inject arbitrary web script or HTML via the (1) sql parameter to dbadd.inc.php, (2) InsertJournal parameter to add_journal_mask.inc.php, (3) InsertBibliography parameter to insert_mask.inc.php, and (4) LabelYear parameter to search_mask.inc.php.

Exploits (1)

exploitdb WORKING POC VERIFIED
by CWH Underground · textwebappsphp
https://www.exploit-db.com/exploits/5716

The exploit demonstrates SQL injection, arbitrary file upload, and XSS vulnerabilities in meBiblio 0.4.7. It includes specific URLs and parameters for exploitation, confirming functional PoC details.

Classification
Working Poc 90%
Attack Type
Sqli | Xss | Other
Complexity
Trivial
Reliability
Reliable
Target: meBiblio 0.4.7
No auth needed
Prerequisites: Access to the target web application · File upload directory must exist for arbitrary file upload
devstral-2 · analyzed Feb 18, 2026 Full analysis →

References (4)

Core 4
Core References
Exploit, Third Party Advisory exploit x_refsource_exploit-db
https://www.exploit-db.com/exploits/5716
Third Party Advisory third-party-advisory x_refsource_secunia
http://secunia.com/advisories/30488
Exploit vdb-entry x_refsource_bid
http://www.securityfocus.com/bid/29465
Third Party Advisory, VDB Entry vdb-entry x_refsource_xf
https://exchange.xforce.ibmcloud.com/vulnerabilities/42760

Scores

EPSS 0.0144
EPSS Percentile 69.8%

Details

CWE
CWE-79
Status published
Products (1)
mebiblio/mebiblio 0.4.7
Published Jun 10, 2008
Tracked Since Feb 18, 2026