CVE-2011-5267
WikiWig 5.01 - Cross-Site Scripting via SpellChecker Module Parameters
Title source: llmExploitation Summary
EIP tracks 2 public exploits for CVE-2011-5267. PoCs published by John Leitch, AutoSec Tools.
AI-analyzed exploit summary The provided text describes an HTML injection vulnerability in Xinha 0.96.1, where user-supplied input is not sufficiently sanitized, allowing attacker-supplied HTML or JavaScript code to execute in the context of the affected site. The example URL demonstrates a reflected XSS payload via the 'to_r_list' parameter.
Description
Multiple cross-site scripting (XSS) vulnerabilities in spell-check-savedicts.php in the SpellChecker module in Xinha, as used in WikiWig 5.01 and possibly other products, allow remote attackers to inject arbitrary web script or HTML via the (1) to_p_dict or (2) to_r_list parameter. NOTE: this issue might be related to the htmlarea plugin and CVE-2013-5670.
Exploits (2)
The provided text describes an HTML injection vulnerability in Xinha 0.96.1, where user-supplied input is not sufficiently sanitized, allowing attacker-supplied HTML or JavaScript code to execute in the context of the affected site. The example URL demonstrates a reflected XSS payload via the 'to_r_list' parameter.
This exploit demonstrates a persistent/reflected XSS vulnerability in WikiWig 5.01. The PoC includes URLs and payloads to trigger arbitrary JavaScript execution, either via reflected parameters or persistent storage through user-editable pages.