CVE-2012-2331

Serendipity < 1.6.1 - Cross-Site Scripting via serendipity[textarea] Parameter

Title source: llm

Exploitation Summary

EIP tracks 1 public exploit for CVE-2012-2331.

AI-analyzed exploit summary The advisory details Cross-Site Scripting (XSS) and SQL Injection (SQLi) vulnerabilities in Serendipity 1.6, providing specific exploit URLs and technical context. It includes disclosure timeline, vendor response, and mitigation steps.

Description

Cross-site scripting (XSS) vulnerability in serendipity/serendipity_admin_image_selector.php in Serendipity before 1.6.1 allows remote attackers to inject arbitrary web script or HTML via the serendipity[textarea] parameter. NOTE: this issue might be resultant from cross-site request forgery (CSRF).

Exploits (1)

exploitdb WRITEUP

webappsphp

https://www.exploit-db.com/exploits/18884

View Code ZIP pw:eip

The advisory details Cross-Site Scripting (XSS) and SQL Injection (SQLi) vulnerabilities in Serendipity 1.6, providing specific exploit URLs and technical context. It includes disclosure timeline, vendor response, and mitigation steps.

Classification

Writeup 100%

Attack Type

Xss | Sqli

Complexity

Trivial

Reliability

Reliable

Target: Serendipity 1.6

No auth needed

Prerequisites: Access to the target Serendipity backend

MITRE ATT&CK