CVE-2010-1724
Zikula Application Framework 1.2.2 - Cross-Site Scripting via Func or Lang Parameter
Title source: llmExploitation Summary
EIP tracks 2 public exploits for CVE-2010-1724. PoCs published by High-Tech Bridge SA.
AI-analyzed exploit summary The exploit demonstrates a reflected XSS vulnerability in Zikula Application Framework 1.2.2 by injecting malicious JavaScript via the 'lang' parameter. The payload executes arbitrary script code in the context of the affected site, potentially stealing cookies or performing other attacks.
Description
Multiple cross-site scripting (XSS) vulnerabilities in Zikula Application Framework 1.2.2, and possibly earlier, allow remote attackers to inject arbitrary web script or HTML via the (1) func parameter to index.php, or the (2) lang parameter to index.php, which is not properly handled by ZLanguage.php.
Exploits (2)
The exploit demonstrates a reflected XSS vulnerability in Zikula Application Framework 1.2.2 by injecting malicious JavaScript via the 'lang' parameter. The payload executes arbitrary script code in the context of the affected site, potentially stealing cookies or performing other attacks.
The exploit demonstrates a reflected XSS vulnerability in Zikula Application Framework by injecting malicious JavaScript via the 'lang' parameter in the URL. The payload executes an alert with the document.cookie, proving arbitrary script execution in the context of the affected site.