CVE-2012-3233

Kayako Fusion 4.40.1148 - Cross-Site Scripting via PATH_INFO in PHPExcel Download Script

Title source: llm

Exploitation Summary

EIP tracks 1 public exploit for CVE-2012-3233. PoCs published by High-Tech Bridge.

AI-analyzed exploit summary This exploit demonstrates a reflected XSS vulnerability in Kayako Fusion by injecting a malicious script via an unsanitized URL parameter. The PoC triggers an alert with the user's cookies, proving arbitrary JavaScript execution.

Description

Cross-site scripting (XSS) vulnerability in __swift/thirdparty/PHPExcel/PHPExcel/Shared/JAMA/docs/download.php in Kayako Fusion 4.40.1148, and possibly before 4.50.1581, allows remote attackers to inject arbitrary web script or HTML via the PATH_INFO.

Exploits (1)

exploitdb WORKING POC VERIFIED

by High-Tech Bridge · textwebappsphp

https://www.exploit-db.com/exploits/37698

View Code ZIP pw:eip

This exploit demonstrates a reflected XSS vulnerability in Kayako Fusion by injecting a malicious script via an unsanitized URL parameter. The PoC triggers an alert with the user's cookies, proving arbitrary JavaScript execution.

Classification

Working Poc 90%

Attack Type

Xss

Complexity

Trivial

Reliability

Reliable

Target: Kayako Fusion 4.40.1148

No auth needed

Prerequisites: Victim must visit the crafted URL

MITRE ATT&CK