CVE-2008-6325
Softbiz Classifieds Script - Cross-Site Scripting via Multiple Parameters
Title source: llmExploitation Summary
EIP tracks 6 public exploits for CVE-2008-6325. PoCs published by Pouya_Server.
AI-analyzed exploit summary This exploit demonstrates a cross-site scripting (XSS) vulnerability in Softbiz Classifieds Script by injecting malicious JavaScript via the 'keyword' parameter in the URL. The payload bypasses basic sanitization using obfuscation techniques like mixed case and URL encoding.
Description
Multiple cross-site scripting (XSS) vulnerabilities in Softbiz Classifieds Script allow remote attackers to inject arbitrary web script or HTML via the (1) radio parameter to showcategory.php, (2) msg parameter to advertisers/signinform.php, (3) radio parameter to gallery.php, (4) msg parameter to lostpassword.php, (5) radio parameter to showcategory.php, (6) msg parameter to admin/adminhome.php, and (7) msg parameter to admin/index.php. NOTE: a different signinform.php file is already covered by CVE-2008-6306.
Exploits (6)
This exploit demonstrates a cross-site scripting (XSS) vulnerability in Softbiz Classifieds Script by injecting malicious JavaScript via the 'keyword' parameter in the URL. The payload bypasses basic sanitization using obfuscation techniques like mixed case and URL encoding.
This exploit demonstrates a cross-site scripting (XSS) vulnerability in Softbiz Classifieds Script by injecting arbitrary JavaScript code via the 'msg' parameter in the lostpassword.php page. The payload bypasses basic sanitization using mixed case and URL encoding.
This exploit demonstrates a reflected XSS vulnerability in Softbiz Classifieds Script by injecting arbitrary JavaScript via the 'keyword' parameter in the gallery.php page. The payload bypasses basic sanitization using mixed case and URL encoding.
This exploit demonstrates a reflected XSS vulnerability in Softbiz Classifieds Script by injecting arbitrary JavaScript via the 'msg' parameter in the signinform.php page. The PoC uses a crafted URL to trigger an alert dialog, proving the lack of input sanitization.
This exploit demonstrates a reflected XSS vulnerability in Softbiz Classifieds Script by injecting malicious JavaScript via the 'msg' parameter in the admin interface. The payload bypasses basic sanitization by using HTML encoding and line breaks.
This exploit demonstrates a cross-site scripting (XSS) vulnerability in Softbiz Classifieds Script by injecting arbitrary JavaScript code via the 'msg' parameter in the adminhome.php page. The payload bypasses basic sanitization by using HTML encoding and line breaks.