CVE-2011-0504

vam_shop 1.6-1.6.1 - Cross-Site Scripting via status, search, or STORE_NAME Parameter

Title source: llm

Exploitation Summary

EIP tracks 1 public exploit for CVE-2011-0504. PoCs published by High-Tech Bridge SA.

AI-analyzed exploit summary The exploit demonstrates multiple CSRF and XSS vulnerabilities in VaM Shop 1.6. It includes PoC code for changing user status, permissions, and executing arbitrary JavaScript via unsanitized input in various admin scripts.

Description

Multiple cross-site scripting (XSS) vulnerabilities in VaM Shop 1.6, 1.6.1, and probably earlier versions llow remote attackers to inject arbitrary web script or HTML via the (1) status parameter to admin/orders.php, (2) search parameter to admin/customers.php, or (3) STORE_NAME parameter to admin/configuration.php.

Exploits (1)

exploitdb WORKING POC

by High-Tech Bridge SA · textwebappsphp

https://www.exploit-db.com/exploits/15968

View Code ZIP pw:eip

The exploit demonstrates multiple CSRF and XSS vulnerabilities in VaM Shop 1.6. It includes PoC code for changing user status, permissions, and executing arbitrary JavaScript via unsanitized input in various admin scripts.

Classification

Working Poc 90%

Attack Type

Xss | Auth Bypass

Complexity

Trivial

Reliability

Reliable

Target: VaM Shop 1.6 and prior versions

Auth required

Prerequisites: Admin access to the target application · Victim interaction for CSRF/XSS

MITRE ATT&CK