CVE-2010-1724

Zikula Application Framework - XSS

Title source: rule

Description

Multiple cross-site scripting (XSS) vulnerabilities in Zikula Application Framework 1.2.2, and possibly earlier, allow remote attackers to inject arbitrary web script or HTML via the (1) func parameter to index.php, or the (2) lang parameter to index.php, which is not properly handled by ZLanguage.php.

Exploits (2)

exploitdb WORKING POC VERIFIED

by High-Tech Bridge SA · textwebappsphp

https://www.exploit-db.com/exploits/33884

View Code ZIP pw:eip

exploitdb WORKING POC VERIFIED

by High-Tech Bridge SA · textwebappsphp

https://www.exploit-db.com/exploits/33885

View Code ZIP pw:eip

References (9)

Core 9

Core References

Third Party Advisory, VDB Entry vdb-entry x_refsource_osvdb

http://www.osvdb.org/64095

Vendor Advisory x_refsource_misc

http://www.htbridge.ch/advisory/xss_vulnerability_in_zikula_application_framework.html

Vendor Advisory x_refsource_misc

http://www.htbridge.ch/advisory/xss_vulnerability_in_zikula_application_framework_1.html

Third Party Advisory, VDB Entry vdb-entry x_refsource_bid

http://www.securityfocus.com/bid/39717

Vendor Advisory third-party-advisory x_refsource_secunia

http://secunia.com/advisories/39614

Third Party Advisory, VDB Entry vdb-entry x_refsource_xf

https://exchange.xforce.ibmcloud.com/vulnerabilities/58224

Vendor Advisory x_refsource_confirm

http://community.zikula.org/index.php?module=News&func=display&sid=3012&title=zikula-1.2.3-release-announcement

Third Party Advisory, VDB Entry mailing-list x_refsource_bugtraq

http://www.securityfocus.com/archive/1/510988/100/0/threaded

Third Party Advisory, VDB Entry vdb-entry x_refsource_osvdb

http://osvdb.org/64096

Scores

EPSS 0.0287

EPSS Percentile 86.3%

Details

CWE

CWE-79

Status published

Products (1)

zikula/zikula_application_framework 1.2.2

Published May 06, 2010

Tracked Since Feb 18, 2026