CVE-2010-3457
Symphony CMS 2.0.7 and 2.1.1 - Cross-Site Scripting via Website Field or Recipient Parameter
Title source: llmExploitation Summary
EIP tracks 1 public exploit for CVE-2010-3457. PoCs published by JosS.
AI-analyzed exploit summary This exploit demonstrates multiple vulnerabilities in Symphony CMS 2.0.7, including SQL injection, XSS, and cookie manipulation via POST parameters. The PoC provides specific payloads for each vulnerability type.
Description
Multiple cross-site scripting (XSS) vulnerabilities in Symphony CMS 2.0.7 and 2.1.1 allow remote attackers to inject arbitrary web script or HTML via the (1) fields[website] parameter in the post comments feature in articles/a-primer-to-symphony-2s-default-theme/ or (2) send-email[recipient] parameter to about/. NOTE: some of these details are obtained from third party information.
Exploits (1)
This exploit demonstrates multiple vulnerabilities in Symphony CMS 2.0.7, including SQL injection, XSS, and cookie manipulation via POST parameters. The PoC provides specific payloads for each vulnerability type.