CVE-2012-1208
Fork CMS 3.2.4 - Cross-Site Scripting via Report or Error Parameter
Title source: llmExploitation Summary
EIP tracks 2 public exploits for CVE-2012-1208. PoCs published by Ivano Binetti, Avram Marius.
AI-analyzed exploit summary This is a detailed writeup describing multiple vulnerabilities in ForkCMS 3.2.5, including CSRF and XSS. It provides proof-of-concept HTML/JS code for exploiting these vulnerabilities but does not contain executable exploit code.
Description
Multiple cross-site scripting (XSS) vulnerabilities in backend/core/engine/base.php in Fork CMS 3.2.4 and possibly other versions before 3.2.5 allow remote attackers to inject arbitrary web script or HTML via the (1) report parameter to blog/settings or (2) error parameter to users/index.
Exploits (2)
This is a detailed writeup describing multiple vulnerabilities in ForkCMS 3.2.5, including CSRF and XSS. It provides proof-of-concept HTML/JS code for exploiting these vulnerabilities but does not contain executable exploit code.
This exploit demonstrates reflected XSS and LFI vulnerabilities in Fork CMS v3.2.4. The XSS payloads are injected via URL parameters, while the LFI allows reading arbitrary files via path traversal.