CVE-2008-7140
@lex_guestbook <= 4.0.5 - Cross-Site Scripting via Language Setup or Test Parameter
Title source: llmExploitation Summary
EIP tracks 2 public exploits for CVE-2008-7140. PoCs published by ZoRLu.
AI-analyzed exploit summary The provided text describes a cross-site scripting (XSS) vulnerability in @lex Guestbook 4.0.5, where user-supplied input is not properly sanitized. The example demonstrates an XSS payload injected via the 'language_setup' parameter in the setup.php file.
Description
Multiple cross-site scripting (XSS) vulnerabilities in @lex Guestbook 4.0.5 and earlier allow remote attackers to inject arbitrary web script or HTML via the (1) language_setup parameter to setup.php or (2) test parameter to index.php. NOTE: the provenance of this information is unknown; the details are obtained solely from third party information. NOTE: a third party has been reported that the test parameter is not used in @lex Guestbook.
Exploits (2)
The provided text describes a cross-site scripting (XSS) vulnerability in @lex Guestbook 4.0.5, where user-supplied input is not properly sanitized. The example demonstrates an XSS payload injected via the 'language_setup' parameter in the setup.php file.
The exploit describes a cross-site scripting (XSS) vulnerability in @lex Guestbook 4.0.5 due to improper input sanitization. The provided URL demonstrates an XSS payload injected via the 'test' parameter, though the vendor disputes its validity.