Exploitation Summary
EIP tracks 1 public exploit for CVE-2008-3398. PoCs published by AzzCoder.
AI-analyzed exploit summary This is a technical writeup detailing multiple vulnerabilities in XMRS CRM, including Remote File Inclusion (RFI), Cross-Site Scripting (XSS), and information disclosure via phpinfo(). The RFI vulnerability requires register_globals to be enabled and targets the $include_directory variable in activities/workflow-activities.php.
Description
Multiple cross-site scripting (XSS) vulnerabilities in XRMS CRM 1.99.2 allow remote attackers to inject arbitrary web script or HTML via the msg parameter to unspecified components, possibly including login.php. NOTE: this may overlap CVE-2008-1129.
Exploits (1)
This is a technical writeup detailing multiple vulnerabilities in XMRS CRM, including Remote File Inclusion (RFI), Cross-Site Scripting (XSS), and information disclosure via phpinfo(). The RFI vulnerability requires register_globals to be enabled and targets the $include_directory variable in activities/workflow-activities.php.