CVE-2009-4458
FreePBX 2.5.2 and 2.6.0rc2 - Cross-Site Scripting via Tech Parameter and Description Parameter
Title source: llmExploitation Summary
EIP tracks 3 public exploits for CVE-2009-4458. PoCs published by Global-Evolution.
AI-analyzed exploit summary This exploit demonstrates a cross-site scripting (XSS) vulnerability in FreePBX 2.5.2 by injecting malicious script code into the 'description' field of a form. It also includes a PHP script to capture cookies via a crafted GET request.
Description
Multiple cross-site scripting (XSS) vulnerabilities in FreePBX 2.5.2 and 2.6.0rc2, and possibly other versions, allow remote attackers to inject arbitrary web script or HTML via the (1) tech parameter to admin/admin/config.php during a trunks display action, the (2) description parameter during an Add Zap Channel action, and (3) unspecified vectors during an Add Recordings action.
Exploits (3)
This exploit demonstrates a cross-site scripting (XSS) vulnerability in FreePBX 2.5.2 by injecting malicious script code into the 'description' field of a form. It also includes a PHP script to capture cookies via a crafted GET request.
This exploit demonstrates a cross-site scripting (XSS) vulnerability in FreePBX by injecting malicious script code via the 'tech' parameter in the URL. The script steals the user's cookie and sends it to an attacker-controlled server.
This exploit demonstrates multiple XSS vulnerabilities in FreePBX, including client-side and server-side attacks. It provides proof-of-concept code for injecting malicious scripts to steal session data (cookies) via crafted URLs and form inputs.