Exploitation Summary
EIP tracks 7 public exploits for CVE-2008-6211. PoCs published by K-9999.
AI-analyzed exploit summary This exploit demonstrates a cross-site scripting (XSS) vulnerability in mcGallery 1.1 by injecting a malicious script into the 'lang' parameter of stats.php. The script executes arbitrary JavaScript in the context of the affected site, potentially stealing cookies.
Description
Multiple cross-site scripting (XSS) vulnerabilities in PhpForums.net mcGallery 1.1 allow remote attackers to inject arbitrary web script or HTML via the lang parameter to (1) admin.php, (2) index.php, (3) sess.php, (4) stats.php, (5) detail.php, (6) resize.php, and (7) show.php. NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.
Exploits (7)
This exploit demonstrates a cross-site scripting (XSS) vulnerability in mcGallery 1.1 by injecting a malicious script into the 'lang' parameter of stats.php. The script executes arbitrary JavaScript in the context of the affected site, potentially stealing cookies.
This exploit demonstrates a cross-site scripting (XSS) vulnerability in mcGallery 1.1 by injecting a malicious script via the 'lang' parameter in the show.php file. The script executes arbitrary JavaScript in the context of the affected site, potentially stealing cookie-based authentication credentials.
This exploit demonstrates a cross-site scripting (XSS) vulnerability in mcGallery 1.1 by injecting a malicious script via the 'lang' parameter in sess.php. The script executes arbitrary JavaScript in the context of the affected site, potentially stealing cookies.
This exploit demonstrates a cross-site scripting (XSS) vulnerability in mcGallery 1.1 by injecting a malicious script via the 'lang' parameter in resize.php. The script executes arbitrary JavaScript in the context of the affected site, potentially stealing cookies.
This exploit demonstrates a cross-site scripting (XSS) vulnerability in mcGallery 1.1 by injecting a malicious script via the 'lang' parameter in the URL. The script executes arbitrary JavaScript in the context of the affected site, potentially stealing cookie-based authentication credentials.
This exploit demonstrates a reflected XSS vulnerability in mcGallery 1.1 by injecting a malicious script via the 'lang' parameter in detail.php. The PoC uses a simple JavaScript alert to confirm the vulnerability.
The provided text describes a cross-site scripting (XSS) vulnerability in mcGallery 1.1, where user-supplied input is not properly sanitized. The example demonstrates a reflected XSS attack via the 'lang' parameter in admin.php.