CVE-2009-4713
XOOPS Celepar Qas Module - Stored Cross-Site Scripting via cod_categoria and opcao Parameters
Title source: llmExploitation Summary
EIP tracks 2 public exploits for CVE-2009-4713. PoCs published by Moudi.
AI-analyzed exploit summary This is a writeup detailing multiple vulnerabilities (Blind SQL Injection and XSS) in the Xoops Celepar Module Qas. It provides example URLs demonstrating the vulnerabilities but does not include executable exploit code.
Description
Multiple cross-site scripting (XSS) vulnerabilities in the Qas (aka Quas) module for XOOPS Celepar allow remote attackers to inject arbitrary web script or HTML via (1) the cod_categoria parameter to categoria.php, (2) the opcao parameter to index.php, and the PATH_INFO to (3) categoria.php and (4) index.php.
Exploits (2)
This is a writeup detailing multiple vulnerabilities (Blind SQL Injection and XSS) in the Xoops Celepar Module Qas. It provides example URLs demonstrating the vulnerabilities but does not include executable exploit code.
The exploit demonstrates a SQL injection vulnerability in the Xoops Celepar module's Aviso.php file, allowing attackers to extract data from the database via crafted input in the 'codigo' parameter.