CVE-2012-3848
Plixer Scrutinizer < 9.5.0 - Cross-Site Scripting via d4d/exporters.php Query String or HTTP Referer Header
Title source: llmExploitation Summary
EIP tracks 1 public exploit for CVE-2012-3848. PoCs published by Mario Ceballos.
AI-analyzed exploit summary This exploit demonstrates a reflected XSS vulnerability in Scrutinizer 9.5.0 by injecting arbitrary JavaScript code via the 'a' parameter in the exporters.php endpoint. The PoC shows how user-supplied input is not properly sanitized, allowing script execution in the context of the affected site.
Description
Multiple cross-site scripting (XSS) vulnerabilities in the web console in Plixer Scrutinizer (aka Dell SonicWALL Scrutinizer) before 9.5.0 allow remote attackers to inject arbitrary web script or HTML via (1) the query string to d4d/exporters.php, (2) the HTTP Referer header to d4d/exporters.php, or (3) unspecified input to d4d/contextMenu.php.
Exploits (1)
This exploit demonstrates a reflected XSS vulnerability in Scrutinizer 9.5.0 by injecting arbitrary JavaScript code via the 'a' parameter in the exporters.php endpoint. The PoC shows how user-supplied input is not properly sanitized, allowing script execution in the context of the affected site.