CVE-2008-6097
wikyblog < 1.7.1 - Cross-Site Scripting via Multiple Parameters
Title source: llmExploitation Summary
EIP tracks 1 public exploit for CVE-2008-6097. PoCs published by Omer Singer.
AI-analyzed exploit summary The exploit demonstrates multiple XSS vulnerabilities in WikyBlog 1.7.1 by injecting iframe tags into various URL parameters. These vulnerabilities arise due to insufficient input sanitization, allowing arbitrary script execution in the context of the affected site.
Description
Multiple cross-site scripting (XSS) vulnerabilities in WikyBlog before 1.7.1 allow remote attackers to inject arbitrary web script or HTML via the (1) key parameter to index.php/Special/Main/keywordSearch, (2) revNum parameter to index.php/Edit/Main/Home, (3) to parameter to index.php/Special/Main/WhatLinksHere, (4) user parameter to index.php/Special/Main/UserEdits, and (5) the PATH_INFO to index.php.
Exploits (1)
The exploit demonstrates multiple XSS vulnerabilities in WikyBlog 1.7.1 by injecting iframe tags into various URL parameters. These vulnerabilities arise due to insufficient input sanitization, allowing arbitrary script execution in the context of the affected site.