Exploitation Summary
EIP tracks 3 public exploits for CVE-2008-3937. PoCs published by C1c4Tr1Z.
AI-analyzed exploit summary This exploit demonstrates a cross-site scripting (XSS) vulnerability in Open Media Collectors Database (OpenDb) by injecting arbitrary JavaScript code via the 'redirect_url' parameter in the user_profile.php page. The PoC uses a simple 'alert(document.cookie)' payload to confirm the vulnerability.
Description
Multiple cross-site scripting (XSS) vulnerabilities in Open Media Collectors Database (OpenDb) 1.0.6 allow remote attackers to inject arbitrary web script or HTML via the (1) user_id parameter in an edit action to user_admin.php, the (2) title parameter to listings.php, and the (3) redirect_url parameter to user_profile.php.
Exploits (3)
This exploit demonstrates a cross-site scripting (XSS) vulnerability in Open Media Collectors Database (OpenDb) by injecting arbitrary JavaScript code via the 'redirect_url' parameter in the user_profile.php page. The PoC uses a simple 'alert(document.cookie)' payload to confirm the vulnerability.
This exploit demonstrates a reflected XSS vulnerability in Open Media Collectors Database (OpenDb) by injecting malicious JavaScript via the 'user_id' parameter in the 'user_admin.php' script. The PoC uses an img tag with an onerror event to execute arbitrary JavaScript, such as stealing cookies.
This exploit demonstrates a cross-site scripting (XSS) vulnerability in Open Media Collectors Database (OpenDb) 1.0.6. The vulnerability arises from insufficient sanitization of user-supplied input in the 'title' parameter, allowing arbitrary JavaScript execution in the context of the affected site.
References (3)
Scores
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N