CVE-2008-3201
Pagefusion 1.5 - Cross-Site Scripting via acct_fname, acct_lname, PID, PGID, or rez Parameters
Title source: llmExploitation Summary
EIP tracks 1 public exploit for CVE-2008-3201. PoCs published by Julian Rodriguez.
AI-analyzed exploit summary This exploit demonstrates multiple XSS vulnerabilities in PageFusion 1.5 by injecting malicious script tags into URL parameters. The PoC shows how unsanitized user input in parameters like `acct_fname`, `acct_lname`, `PID`, and `PGID` can execute arbitrary JavaScript in the context of the affected site.
Description
Multiple cross-site scripting (XSS) vulnerabilities in index.php in Pagefusion 1.5 allow remote attackers to inject arbitrary web script or HTML via the (1) acct_fname and (2) acct_lname parameters in an edit action, and the (3) PID, (4) PGID, and (5) rez parameters. NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.
Exploits (1)
This exploit demonstrates multiple XSS vulnerabilities in PageFusion 1.5 by injecting malicious script tags into URL parameters. The PoC shows how unsanitized user input in parameters like `acct_fname`, `acct_lname`, `PID`, and `PGID` can execute arbitrary JavaScript in the context of the affected site.