CVE-2010-3602

mojoPortal 2.3.4.3 and 2.3.5.1 - Cross-Site Scripting via User ID Parameter

Title source: llm

Exploitation Summary

EIP tracks 1 public exploit for CVE-2010-3602. PoCs published by Abysssec.

AI-analyzed exploit summary The document describes two vulnerabilities in mojoPortal 2-3-4-3: a CSRF vulnerability allowing file movement and a persistent XSS vulnerability in the user registration page. It includes proof-of-concept details and vulnerable code snippets.

Description

Cross-site scripting (XSS) vulnerability in ProfileView.aspx in mojoPortal 2.3.4.3 and 2.3.5.1 allows remote attackers to inject arbitrary web script or HTML via the User ID parameter. NOTE: some of these details are obtained from third party information.

Exploits (1)

exploitdb WRITEUP VERIFIED

by Abysssec · textwebappsasp

https://www.exploit-db.com/exploits/15018

View Code ZIP pw:eip

The document describes two vulnerabilities in mojoPortal 2-3-4-3: a CSRF vulnerability allowing file movement and a persistent XSS vulnerability in the user registration page. It includes proof-of-concept details and vulnerable code snippets.

Classification

Writeup 90%

Attack Type

Xss | Info Leak

Complexity

Moderate

Reliability

Reliable

Target: mojoPortal 2-3-4-3

Auth required

Prerequisites: Admin session for CSRF attack · User registration access for XSS

MITRE ATT&CK