CVE-2010-3023
DiamondList 0.1.6 - Cross-Site Scripting via Category Description and Site Title Parameters
Title source: llmExploitation Summary
EIP tracks 2 public exploits for CVE-2010-3023. PoCs published by High-Tech Bridge SA.
AI-analyzed exploit summary This exploit demonstrates a cross-site scripting (XSS) vulnerability in DiamondList 0.1.6 by injecting malicious JavaScript into the 'site_title' parameter. The PoC submits a form with crafted input to trigger the XSS payload, which executes arbitrary JavaScript in the context of the victim's browser.
Description
Multiple cross-site scripting (XSS) vulnerabilities in DiamondList 0.1.6, and possibly earlier, allow remote attackers to inject arbitrary web script or HTML via the (1) category[description] parameter to user/main/update_category, which is not properly handled by _app/views/categories/index.html.erb; and the (2) setting[site_title] parameter to user/main/update_settings, which is not properly handled by _app/views/settings/_list_settings.rhtml.
Exploits (2)
This exploit demonstrates a cross-site scripting (XSS) vulnerability in DiamondList 0.1.6 by injecting malicious JavaScript into the 'site_title' parameter. The PoC submits a form with crafted input to trigger the XSS payload, which executes arbitrary JavaScript in the context of the victim's browser.
This exploit demonstrates a cross-site scripting (XSS) vulnerability in DiamondList 0.1.6 by injecting malicious JavaScript into the 'category[description]' parameter. The script automatically submits a form to trigger the XSS payload, which executes in the context of the affected browser.