CVE-2008-2787

OpenDocMan 1.2.5 - Cross-Site Scripting via out.php last_message Parameter

Title source: llm

Exploitation Summary

EIP tracks 1 public exploit for CVE-2008-2787. PoCs published by Sergi Rosello.

AI-analyzed exploit summary This exploit demonstrates a reflected XSS vulnerability in OpenDocMan 1.2.5 by injecting a script tag via the 'last_message' parameter in the 'out.php' file. The PoC uses a simple alert to display the user's cookies, proving arbitrary JavaScript execution.

Description

Cross-site scripting (XSS) vulnerability in out.php in OpenDocMan 1.2.5 allows remote attackers to inject arbitrary web script or HTML via the last_message parameter.

Exploits (1)

exploitdb WORKING POC VERIFIED

by Sergi Rosello · textwebappsphp

https://www.exploit-db.com/exploits/31933

View Code ZIP pw:eip

This exploit demonstrates a reflected XSS vulnerability in OpenDocMan 1.2.5 by injecting a script tag via the 'last_message' parameter in the 'out.php' file. The PoC uses a simple alert to display the user's cookies, proving arbitrary JavaScript execution.

Classification

Working Poc 90%

Attack Type

Xss

Complexity

Trivial

Reliability

Reliable

Target: OpenDocMan 1.2.5

No auth needed

Prerequisites: Access to the vulnerable 'out.php' endpoint

MITRE ATT&CK