CVE-2008-7134

Redgalaxy Download Center - XSS

Title source: rule

Description

Multiple cross-site scripting (XSS) vulnerabilities in the default URI in Chris LaPointe RedGalaxy Download Center 1.2 allow remote attackers to inject arbitrary web script or HTML via the (1) file parameter, (2) message parameter in a login action, (3) category parameter in a browse action, (4) now parameter, or (5) search parameter in a search_results action. NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.

Exploits (3)

exploitdb WORKING POC VERIFIED

by ZoRLu · textwebappsphp

https://www.exploit-db.com/exploits/31391

View Code ZIP pw:eip

exploitdb WORKING POC VERIFIED

by ZoRLu · textwebappsphp

https://www.exploit-db.com/exploits/31390

View Code ZIP pw:eip

exploitdb WORKING POC VERIFIED

by ZoRLu · textwebappsphp

https://www.exploit-db.com/exploits/31389

View Code ZIP pw:eip

References (3)

[Patch] http://download.redgalaxy.net/?nav=home

[Exploit] http://www.securityfocus.com/bid/28219

[Third Party Advisory, VDB Entry] https://exchange.xforce.ibmcloud.com/vulnerabilities/41198

Scores

EPSS 0.0012

EPSS Percentile 30.8%

Classification

CWE

CWE-79

Status published

Affected Products (2)

redgalaxy/download_center

n/a/n/a

Timeline

Published Sep 01, 2009

Tracked Since Feb 18, 2026