CVE-2010-4513
zimplit_cms < 3.0 - Cross-Site Scripting via file and client Parameters
Title source: llmExploitation Summary
EIP tracks 3 public exploits for CVE-2010-4513. PoCs published by Yashar shahinzadeh, High-Tech Bridge SA.
AI-analyzed exploit summary The exploit demonstrates multiple vulnerabilities in Zimplit CMS 3.0, including XSS, CSRF, directory traversal, local file disclosure, password change, and shell upload. It provides functional proof-of-concept code and detailed technical analysis of the affected functions.
Description
Multiple cross-site scripting (XSS) vulnerabilities in Zimplit CMS 3.0, and possibly earlier, allow remote attackers to inject arbitrary web script or HTML via the (1) file parameter in a load action to zimplit.php and (2) client parameter to English_manual_version_2.php.
Exploits (3)
The exploit demonstrates multiple vulnerabilities in Zimplit CMS 3.0, including XSS, CSRF, directory traversal, local file disclosure, password change, and shell upload. It provides functional proof-of-concept code and detailed technical analysis of the affected functions.
The exploit demonstrates a reflected XSS vulnerability in Zimplit CMS by injecting a malicious script via the 'file' parameter in the 'load' action. The payload executes arbitrary JavaScript in the context of the affected site, potentially stealing cookies or performing other client-side attacks.
The exploit demonstrates a reflected XSS vulnerability in Zimplit CMS by injecting a malicious script via the 'client' parameter in the URL. The payload executes arbitrary JavaScript in the context of the affected site, potentially stealing cookies or performing other malicious actions.