CVE-2008-3301
BilboBlog 0.2.1 - Authenticated Cross-Site Scripting via Multiple Parameters
Title source: llmExploitation Summary
EIP tracks 1 public exploit for CVE-2008-3301. PoCs published by BlackH.
AI-analyzed exploit summary This exploit demonstrates multiple vulnerabilities in Bilboblog 2.1, including login bypass, XSS, SQL injection, and full path disclosure. The PoC includes a Ruby script for SQL injection via admin panel.
Description
Multiple cross-site scripting (XSS) vulnerabilities in BilboBlog 0.2.1 allow remote authenticated administrators to inject arbitrary web script or HTML via the (1) content parameter to admin/update.php, related to conflicting code in widget.php; and allow remote attackers to inject arbitrary web script or HTML via the (2) titleId parameter to head.php, reachable through index.php; the (3) t_lang[lang_copyright] parameter to footer.php; the (4) content parameter to the default URI under admin/; the (5) url, (6) t_lang[lang_admin_help], (7) t_lang[lang_admin_clear_cache], (8) t_lang[lang_admin_home], and (9) t_lang[lang_admin_logout] parameters to admin/homelink.php; and the (10) t_lang[lang_admin_new_post] parameter to admin/post.php. NOTE: some of these details are obtained from third party information.
Exploits (1)
This exploit demonstrates multiple vulnerabilities in Bilboblog 2.1, including login bypass, XSS, SQL injection, and full path disclosure. The PoC includes a Ruby script for SQL injection via admin panel.