CVE-2012-1001
MEDIUMChyrp < 2.1.2 - Cross-Site Scripting via Content or Body Parameter
Title source: llmExploitation Summary
EIP tracks 2 public exploits for CVE-2012-1001. PoCs published by High-Tech Bridge SA.
AI-analyzed exploit summary This exploit demonstrates an HTML injection vulnerability in Chyrp 2.1.2 by submitting a malicious script via a POST request to error.php, which executes arbitrary JavaScript in the context of the user's browser.
Description
Multiple cross-site scripting (XSS) vulnerabilities in Chyrp before 2.1.2 and before 2.5 Beta 2 allow remote attackers to inject arbitrary web script or HTML via the (1) content parameter to includes/ajax.php or (2) body parameter to includes/error.php.
Exploits (2)
This exploit demonstrates an HTML injection vulnerability in Chyrp 2.1.2 by submitting a malicious script via a POST request to error.php, which executes arbitrary JavaScript in the context of the user's browser.
This exploit demonstrates an HTML injection vulnerability in Chyrp 2.1.1 by submitting a malicious script via a form to the ajax.php endpoint, which fails to sanitize user input. The script executes in the context of the affected browser, potentially stealing cookies or manipulating the site's rendering.
References (6)
Scores
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N