CVE-2009-1067

Pixie CMS 1.01a - Cross-Site Scripting via Index.php X Parameter

Title source: llm

Exploitation Summary

EIP tracks 1 public exploit for CVE-2009-1067. PoCs published by Justin Keane.

AI-analyzed exploit summary This writeup details multiple vulnerabilities in Pixie CMS, including XSS via the 'x' parameter in blog URLs and SQL injection via the 'Referer' header. The XSS allows redirection or arbitrary script execution, while the SQL injection can manipulate the 'pixie_log' table.

Description

Cross-site scripting (XSS) vulnerability in index.php in Pixie CMS 1.01a allows remote attackers to inject arbitrary web script or HTML via the x parameter.

Exploits (1)

exploitdb WRITEUP VERIFIED

by Justin Keane · textwebappsphp

https://www.exploit-db.com/exploits/8252

View Code ZIP pw:eip

This writeup details multiple vulnerabilities in Pixie CMS, including XSS via the 'x' parameter in blog URLs and SQL injection via the 'Referer' header. The XSS allows redirection or arbitrary script execution, while the SQL injection can manipulate the 'pixie_log' table.

Classification

Writeup 90%

Attack Type

Xss | Sqli

Complexity

Trivial

Reliability

Reliable

Target: Pixie CMS (version not specified)

No auth needed

Prerequisites: Access to a vulnerable Pixie CMS instance · Ability to manipulate HTTP headers and URL parameters

MITRE ATT&CK