CVE-2012-2938
Travelon Express 6.2.2 - Cross-Site Scripting via Holiday Name Field
Title source: llmExploitation Summary
EIP tracks 1 public exploit for CVE-2012-2938. PoCs published by Vulnerability-Lab.
AI-analyzed exploit summary The exploit demonstrates multiple vulnerabilities in Travelon Express CMS v6.2.2, including SQL injection, persistent XSS, and arbitrary file upload. It provides detailed PoC examples for each vulnerability, including specific endpoints and payloads.
Description
Multiple cross-site scripting (XSS) vulnerabilities in Travelon Express 6.2.2 allow remote attackers to inject arbitrary web script or HTML via the holiday name field to (1) holiday_add.php or (2) holiday_view.php.
Exploits (1)
The exploit demonstrates multiple vulnerabilities in Travelon Express CMS v6.2.2, including SQL injection, persistent XSS, and arbitrary file upload. It provides detailed PoC examples for each vulnerability, including specific endpoints and payloads.