CVE-2009-2882
PG MatchMaking - Cross-Site Scripting via show/gender/id Parameters
Title source: llmExploitation Summary
EIP tracks 4 public exploits for CVE-2009-2882. PoCs published by Moudi.
AI-analyzed exploit summary This exploit demonstrates a cross-site scripting (XSS) vulnerability in PG Matchmaking by injecting a script tag into the 'id' parameter of the services.php page. The PoC uses a simple alert to display the user's cookies, proving the vulnerability.
Description
Multiple cross-site scripting (XSS) vulnerabilities in PG MatchMaking allow remote attackers to inject arbitrary web script or HTML via the show parameter to (1) browse_ladies.php and (2) browse_men.php, the (3) gender parameter to search.php, and the (4) id parameter to services.php.
Exploits (4)
This exploit demonstrates a cross-site scripting (XSS) vulnerability in PG Matchmaking by injecting a script tag into the 'id' parameter of the services.php page. The PoC uses a simple alert to display the user's cookies, proving the vulnerability.
This exploit demonstrates a cross-site scripting (XSS) vulnerability in PG Matchmaking by injecting a script tag into the 'gender' parameter of the search.php page. The PoC uses a simple alert to display the user's cookies, proving arbitrary JavaScript execution.
This exploit demonstrates a cross-site scripting (XSS) vulnerability in PG Matchmaking by injecting a malicious script via the 'show' parameter in the URL. The script executes arbitrary JavaScript in the context of the affected site, potentially stealing cookies.
This exploit demonstrates a cross-site scripting (XSS) vulnerability in PG Matchmaking by injecting a script tag into the 'show' parameter of the browse_ladies.php page. The PoC uses a simple alert to display the user's cookies, proving arbitrary script execution.