CVE-2010-3425

SmarterStats 5.3 - Cross-Site Scripting via frmHelp.aspx url Parameter

Title source: llm
STIX 2.1

Exploitation Summary

EIP tracks 1 public exploit for CVE-2010-3425. PoCs published by sqlhacker.

AI-analyzed exploit summary This is a proof-of-concept for a stored XSS vulnerability in SmarterMail 7.x (7.2.3925). The exploit demonstrates how arbitrary JavaScript can be injected via the `ctl00%24MPH%24SubjectBox_SettingText` parameter and rendered in the application's response.

Description

Cross-site scripting (XSS) vulnerability in UserControls/Popups/frmHelp.aspx in SmarterStats 5.3, 5.3.3819, and possibly other 5.3 versions, allows remote attackers to inject arbitrary web script or HTML via the url parameter.

Exploits (1)

exploitdb WORKING POC VERIFIED
by sqlhacker · textwebappsasp
https://www.exploit-db.com/exploits/15185

This is a proof-of-concept for a stored XSS vulnerability in SmarterMail 7.x (7.2.3925). The exploit demonstrates how arbitrary JavaScript can be injected via the `ctl00%24MPH%24SubjectBox_SettingText` parameter and rendered in the application's response.

Classification
Working Poc 95%
Attack Type
Xss
Complexity
Trivial
Reliability
Reliable
Target: SmarterMail 7.x (7.2.3925)
Auth required
Prerequisites: Access to a vulnerable SmarterMail instance · Valid session cookies
MITRE ATT&CK
devstral-2 · analyzed Feb 16, 2026 Full analysis →

References (4)

Core 4
Core References
Vendor Advisory third-party-advisory x_refsource_secunia
http://secunia.com/advisories/41389
Exploit vdb-entry x_refsource_osvdb
http://www.osvdb.org/67895
Third Party Advisory, VDB Entry vdb-entry x_refsource_xf
https://exchange.xforce.ibmcloud.com/vulnerabilities/61724

Scores

EPSS 0.0148
EPSS Percentile 70.6%

Details

CWE
CWE-79
Status published
Products (2)
smartertools/smarterstats 5.3
smartertools/smarterstats 5.3.3819
Published Sep 16, 2010
Tracked Since Feb 18, 2026