CVE-2012-0984
XOOPS < 2.5.5 - Cross-Site Scripting via Multiple Parameters
Title source: llmExploitation Summary
EIP tracks 3 public exploits for CVE-2012-0984. PoCs published by High-Tech Bridge SA.
AI-analyzed exploit summary The exploit demonstrates multiple XSS vulnerabilities in XOOPS 2.5.4 by injecting malicious scripts via unsanitized POST parameters in various endpoints. Each PoC uses a form submission to trigger the XSS payload, confirming the vulnerability.
Description
Multiple cross-site scripting (XSS) vulnerabilities in XOOPS before 2.5.5 allow remote attackers to inject arbitrary web script or HTML via the (1) to_userid parameter to modules/pm/pmlite.php or the (2) current_file, (3) imgcat_id, or (4) target parameter to class/xoopseditor/tinymce/tinymce/jscripts/tiny_mce/plugins/xoopsimagemanager/xoopsimagebrowser.php.
Exploits (3)
The exploit demonstrates multiple XSS vulnerabilities in XOOPS 2.5.4 by injecting malicious scripts via unsanitized POST parameters in various endpoints. Each PoC uses a form submission to trigger the XSS payload, confirming the vulnerability.
This exploit demonstrates multiple XSS vulnerabilities in XOOPS by injecting malicious scripts into form inputs. The PoC shows how unsanitized user input in parameters like 'current_file', 'imgcat_id', and 'target' can lead to arbitrary JavaScript execution.
This exploit demonstrates a stored XSS vulnerability in XOOPS 2.5.4 by injecting malicious JavaScript into the 'to_userid' parameter of the private messaging module. The PoC form submits a payload that executes arbitrary script code in the context of the affected site.