CVE-2010-4850

Diferior 8.03 - Stored Cross-Site Scripting via Post Content or Admin Parameters

Title source: llm

Exploitation Summary

EIP tracks 1 public exploit for CVE-2010-4850. PoCs published by High-Tech Bridge SA.

AI-analyzed exploit summary The exploit demonstrates stored XSS vulnerabilities in Diferior CMS by injecting malicious JavaScript into unsanitized input fields (post_content, slogan, subcatname). The PoC includes auto-submitting forms to trigger the payloads.

Description

Multiple cross-site scripting (XSS) vulnerabilities in Diferior 8.03 allow remote attackers to inject arbitrary web script or HTML via the (1) post_content parameter to post/edit/2/p1.html, related to views/post.php; the (2) slogan parameter to admin/site/2.html, related to views/admin.php; or the (3) subcatname or (4) description parameter to admin/forum/create_sub.html, related to views/admin.php.

Exploits (1)

exploitdb WORKING POC

by High-Tech Bridge SA · htmlwebappsphp

https://www.exploit-db.com/exploits/15633

View Code ZIP pw:eip

The exploit demonstrates stored XSS vulnerabilities in Diferior CMS by injecting malicious JavaScript into unsanitized input fields (post_content, slogan, subcatname). The PoC includes auto-submitting forms to trigger the payloads.

Classification

Working Poc 100%

Attack Type

Xss

Complexity

Trivial

Reliability

Reliable

Target: Diferior CMS 8.03 and prior

Auth required

Prerequisites: Access to vulnerable admin/post edit pages · Valid session/authentication

MITRE ATT&CK