CVE-2008-4696
Opera - Stored Cross-Site Scripting via History Search Database
Title source: llmExploitation Summary
EIP tracks 4 public exploits for CVE-2008-4696.
PoCs published by Metasploit, egypt, Roberto Suggi Liverani, including Metasploit module exploits/multi/browser/opera_historysearch.
AI-analyzed exploit summary This Metasploit module exploits a cross-site scripting (XSS) vulnerability in Opera's history search functionality to achieve arbitrary command execution. It leverages the vulnerability to modify Opera's configuration settings and execute commands via the mail handler.
Description
Cross-site scripting (XSS) vulnerability in Opera.dll in Opera before 9.61 allows remote attackers to inject arbitrary web script or HTML via the anchor identifier (aka the "optional fragment"), which is not properly escaped before storage in the History Search database (aka md.dat).
Exploits (4)
This Metasploit module exploits a cross-site scripting (XSS) vulnerability in Opera's history search functionality to achieve arbitrary command execution. It leverages the vulnerability to modify Opera's configuration settings and execute commands via the mail handler.
This Metasploit module exploits a cross-site scripting (XSS) vulnerability in Opera's history search functionality, allowing arbitrary command execution by manipulating Opera's configuration settings via JavaScript injection. The exploit targets Opera versions between 9.50 and 9.61.
This is a detailed writeup describing a stored XSS vulnerability in Opera browser (CVE-2008-4725), where malicious JavaScript can be injected via the URL fragment and executed when the user visits the history search page.
This Metasploit module exploits a cross-site scripting (XSS) vulnerability in Opera's history search functionality (CVE-2008-4696) to achieve arbitrary command execution by manipulating Opera's mail handler preferences via JavaScript injection.