CVE-2012-1110
Etano < 1.22 - Cross-Site Scripting via Multiple Parameters
Title source: llmExploitation Summary
EIP tracks 3 public exploits for CVE-2012-1110. PoCs published by Aung Khant.
AI-analyzed exploit summary This exploit demonstrates multiple reflected XSS vulnerabilities in Etano versions 1.20 to 1.22. The PoC includes URLs with injected JavaScript payloads that trigger alerts, confirming the lack of proper input sanitization.
Description
Multiple cross-site scripting (XSS) vulnerabilities in Etano 1.22 and earlier allow remote attackers to inject arbitrary web script or HTML via the (1) user, (2) email, (3) email2, (4) f17_zip, or (5) agree parameter to join.php; (6) PATH_INFO, (7) st, (8) f17_city, (9) f17_country, (10) f17_state, (11) f17_zip, (12) f19, (13) wphoto, (14) search, or (15) v parameter to search.php; (16) PATH_INFO or (17) st parameter to photo_search.php; or (18) return parameter to photo_view.php.
Exploits (3)
This exploit demonstrates multiple reflected XSS vulnerabilities in Etano versions 1.20 to 1.22. The PoC includes URLs with injected JavaScript payloads that trigger alerts, confirming the lack of proper input sanitization.
This exploit demonstrates a reflected XSS vulnerability in Etano versions 1.20 to 1.22. The PoC injects arbitrary JavaScript via the 'return' parameter in the photo_view.php URL, which executes in the context of the affected site.
The exploit demonstrates XSS vulnerabilities in Etano by injecting arbitrary JavaScript via unsanitized input parameters in photo_search.php. The PoC uses simple script tags to trigger an alert, confirming the vulnerability.