Exploitation Summary
EIP tracks 6 public exploits for CVE-2008-3668. PoCs published by Lostmon.
AI-analyzed exploit summary The exploit demonstrates a reflected XSS vulnerability in Yogurt Social Network by injecting a script tag into the 'uid' parameter of the tribes.php module. The lack of input sanitization allows arbitrary JavaScript execution in the context of the affected site.
Description
Multiple cross-site scripting (XSS) vulnerabilities in the Yogurt Social Network module 3.2 rc1 for XOOPS allow remote attackers to inject arbitrary web script or HTML via the uid parameter to (1) friends.php, (2) seutubo.php, (3) album.php, (4) scrapbook.php, (5) index.php, or (6) tribes.php; or (7) the description field of a new scrap.
Exploits (6)
The exploit demonstrates a reflected XSS vulnerability in Yogurt Social Network by injecting a script tag into the 'uid' parameter of the tribes.php module. The lack of input sanitization allows arbitrary JavaScript execution in the context of the affected site.
The exploit demonstrates a reflected XSS vulnerability in Yogurt Social Network 3.2 rc1 by injecting a script tag into the 'uid' parameter of the 'seutubo.php' module. The lack of input sanitization allows arbitrary JavaScript execution in the context of the affected site.
The exploit demonstrates a reflected XSS vulnerability in Yogurt Social Network by injecting a script tag into the 'uid' parameter of the scrapbook.php module. The lack of input sanitization allows arbitrary JavaScript execution in the context of the affected site.
The exploit demonstrates a reflected XSS vulnerability in Yogurt Social Network by injecting a script tag into the 'uid' parameter of the index.php file. The lack of input sanitization allows arbitrary JavaScript execution in the context of the affected site.
The exploit demonstrates a reflected XSS vulnerability in Yogurt Social Network 3.2 rc1 by injecting a script tag into the 'uid' parameter of the friends.php module. The PoC shows how arbitrary JavaScript can be executed in the context of the affected site.
The exploit demonstrates a reflected XSS vulnerability in Yogurt Social Network 3.2 rc1 by injecting a script tag into the 'uid' parameter of the album.php module. The lack of input sanitization allows arbitrary JavaScript execution in the context of the affected site.