andreas-kurtz.de
http://www.andreas-kurtz.de/advisories/AKADV2008-001-v1.0.txt CVE-2008-6510
Openfire Server 3.6.0a - Authentication Bypass / SQL Injection / Cross-Site Scripting
Record summary
CVE-2008-6510 has a selected CVSS score of 4.3; EIP currently links 1 catalogued exploit.
Description
Cross-site scripting (XSS) vulnerability in login.jsp in the Admin Console in Openfire 3.6.0a and earlier allows remote attackers to inject arbitrary web script or HTML via the url parameter.
Description source: CVE List
Exploitation context
Available material
- Catalogued exploits
- 1
Proofs of concept
1Catalogued exploits
ExploitDBOpenfire Server 3.6.0a - Authentication Bypass / SQL Injection / Cross-Site ScriptingExploitDB exploitby Andreas KurtzNot analyzed1 file
References
8igniterealtime.orgConfirmation
http://www.igniterealtime.org/issues/browse/JM-629 20081108 [AK-ADV2008-001] Openfire Jabber-Server: Multiple Vulnerabilities (Authentication Bypass, SQL injection, ...)mailing list
http://www.securityfocus.com/archive/1/498162/100/0/threaded 32189vdb entry
http://www.securityfocus.com/bid/32189 ADV-2008-3061vdb entry
http://www.vupen.com/english/advisories/2008/3061 openfire-url-xss(46486)vdb entry
https://exchange.xforce.ibmcloud.com/vulnerabilities/46486 nvd.nist.gov
https://nvd.nist.gov/vuln/detail/CVE-2008-6510 7075exploit
https://www.exploit-db.com/exploits/7075