CVE-2012-0873

Boonex Dolphin <7.0.8 - XSS

Title source: llm

Description

Multiple cross-site scripting (XSS) vulnerabilities in Boonex Dolphin before 7.0.8 allow remote attackers to inject arbitrary web script or HTML via the (1) explain parameter to explanation.php or the (2) photos_only, (3) online_only, or (4) mode parameters to viewFriends.php.

Exploits (2)

exploitdb WORKING POC VERIFIED

by Aung Khant · textwebappsphp

https://www.exploit-db.com/exploits/36853

View Code ZIP pw:eip

exploitdb WORKING POC VERIFIED

by Aung Khant · textwebappsphp

https://www.exploit-db.com/exploits/36854

View Code ZIP pw:eip

References (9)

[Exploit] http://www.openwall.com/lists/oss-security/2012/02/20/6

[Exploit] http://archives.neohapsis.com/archives/bugtraq/2012-02/0107.html

[Various Sources] http://www.boonex.com/n/dolphin-7-0-8-released

[Patch] http://www.boonex.com/trac/dolphin/changeset/15282

[Exploit, Patch] http://www.boonex.com/trac/dolphin/changeset/15283

[Patch] http://www.boonex.com/trac/dolphin/ticket/2530

[Exploit] http://www.openwall.com/lists/oss-security/2012/02/20/11

[Exploit] http://www.securityfocus.com/bid/52088

[Exploit] http://yehg.net/lab/pr0js/advisories/%5BDolphin_7.0.7%5D_xss

Scores

EPSS 0.0734

EPSS Percentile 91.6%

Classification

CWE

CWE-79

Status published

Affected Products (13)

boonex/dolphin < 7.0.7

boonex/dolphin

boonex/dolphin

boonex/dolphin

boonex/dolphin

boonex/dolphin

boonex/dolphin

boonex/dolphin

boonex/dolphin

boonex/dolphin

boonex/dolphin

boonex/dolphin

n/a/n/a

Timeline

Published Feb 23, 2012

Tracked Since Feb 18, 2026