CVE-2011-4709
Hotaru CMS Search Plugin 1.3 - Cross-Site Scripting via SITE_NAME, return, or search Parameters
Title source: llmExploitation Summary
EIP tracks 1 public exploit for CVE-2011-4709. PoCs published by Gjoko Krstic.
AI-analyzed exploit summary This HTML file demonstrates a stored XSS vulnerability in Hotaru CMS 1.4.2 by injecting malicious JavaScript into the SITE_NAME parameter and other input fields. It includes multiple attack vectors, such as the return and search parameters, to trigger XSS payloads.
Description
Multiple cross-site scripting (XSS) vulnerabilities in Hotaru.php in the Search plugin 1.3 for Hotaru CMS allow remote attackers to inject arbitrary web script or HTML via the (1) SITE_NAME parameter to admin_index.php, or the (2) return and (3) search parameters to index.php. NOTE: some of these details are obtained from third party information.
Exploits (1)
This HTML file demonstrates a stored XSS vulnerability in Hotaru CMS 1.4.2 by injecting malicious JavaScript into the SITE_NAME parameter and other input fields. It includes multiple attack vectors, such as the return and search parameters, to trigger XSS payloads.