CVE-2009-4250
CutePHP CuteNews 1.4.6 and UTF-8 CuteNews < 8b - Cross-Site Scripting via Multiple Parameters
Title source: llmExploitation Summary
EIP tracks 2 public exploits for CVE-2009-4250. PoCs published by Andrew Horton.
AI-analyzed exploit summary This is a detailed security advisory describing multiple vulnerabilities in Cute News and UTF-8 Cute News, including XSS, CSRF, LFI, and command injection. It provides technical descriptions, proof-of-concept exploits, and affected versions.
Description
Multiple cross-site scripting (XSS) vulnerabilities in CutePHP CuteNews 1.4.6 and UTF-8 CuteNews before 8b allow remote attackers to inject arbitrary web script or HTML via (1) the result parameter to register.php; (2) the user parameter to search.php; the (3) cat_msg, (4) source_msg, (5) postponed_selected, (6) unapproved_selected, and (7) news_per_page parameters in a list action to the editnews module of index.php; and (8) the link tag in news comments. NOTE: some of the vulnerabilities require register_globals to be enabled and/or magic_quotes_gpc to be disabled.
Exploits (2)
This is a detailed security advisory describing multiple vulnerabilities in Cute News and UTF-8 Cute News, including XSS, CSRF, LFI, and command injection. It provides technical descriptions, proof-of-concept exploits, and affected versions.
The provided text describes multiple vulnerabilities in CuteNews and UTF-8 CuteNews, including XSS, HTML injection, and security bypass issues. It includes a sample XSS payload but lacks executable exploit code.