CVE-2012-0873

Boonex Dolphin <7.0.8 - XSS

Title source: llm
STIX 2.1

Description

Multiple cross-site scripting (XSS) vulnerabilities in Boonex Dolphin before 7.0.8 allow remote attackers to inject arbitrary web script or HTML via the (1) explain parameter to explanation.php or the (2) photos_only, (3) online_only, or (4) mode parameters to viewFriends.php.

Exploits (2)

exploitdb WORKING POC VERIFIED
by Aung Khant · textwebappsphp
https://www.exploit-db.com/exploits/36853
exploitdb WORKING POC VERIFIED
by Aung Khant · textwebappsphp
https://www.exploit-db.com/exploits/36854

References (9)

Core 9
Core References
Exploit vdb-entry x_refsource_bid
http://www.securityfocus.com/bid/52088
Exploit mailing-list x_refsource_bugtraq
http://archives.neohapsis.com/archives/bugtraq/2012-02/0107.html
Various Sources x_refsource_confirm
http://www.boonex.com/n/dolphin-7-0-8-released
Exploit, Patch x_refsource_confirm
http://www.boonex.com/trac/dolphin/changeset/15283
Exploit mailing-list x_refsource_mlist
http://www.openwall.com/lists/oss-security/2012/02/20/11
Exploit mailing-list x_refsource_mlist
http://www.openwall.com/lists/oss-security/2012/02/20/6

Scores

EPSS 0.0734
EPSS Percentile 91.8%

Details

CWE
CWE-79
Status published
Products (11)
boonex/dolphin 5.1
boonex/dolphin 5.2
boonex/dolphin 6.1.2
boonex/dolphin 7.0.0
boonex/dolphin 7.0.1
boonex/dolphin 7.0.2
boonex/dolphin 7.0.3 (2 CPE variants)
boonex/dolphin 7.0.4
boonex/dolphin 7.0.5
boonex/dolphin 7.0.6
... and 1 more
Published Feb 23, 2012
Tracked Since Feb 18, 2026