CVE-2012-6517

diy-cms 1.0 - Cross-Site Scripting via Poll Module Parameters

Title source: llm
STIX 2.1

Exploitation Summary

EIP tracks 1 public exploit for CVE-2012-6517. PoCs published by Vulnerability-Lab.

AI-analyzed exploit summary This document describes multiple vulnerabilities in DIY CMS v1.0, including SQL injection, XSS, and CSRF. It provides proof-of-concept examples and mitigation steps but does not include executable exploit code.

Description

Multiple cross-site scripting (XSS) vulnerabilities in DiY-CMS 1.0 allow remote attackers to inject arbitrary web script or HTML via the (1) question parameter to in /modules/poll/add.php or (2) question or (3) answer parameter to modules/poll/edit.php.

Exploits (1)

exploitdb WRITEUP VERIFIED
by Vulnerability-Lab · textwebappsphp
https://www.exploit-db.com/exploits/18804

This document describes multiple vulnerabilities in DIY CMS v1.0, including SQL injection, XSS, and CSRF. It provides proof-of-concept examples and mitigation steps but does not include executable exploit code.

Classification
Writeup 90%
Attack Type
Sqli | Xss | Csrf
Complexity
Moderate
Reliability
Theoretical
Target: DIY CMS v1.0
No auth needed
Prerequisites: Access to the poll module · Ability to craft malicious input
devstral-2 · analyzed Feb 16, 2026 Full analysis →

References (7)

Core 7
Core References
Exploit exploit x_refsource_exploit-db
http://www.exploit-db.com/exploits/18804
Third Party Advisory, VDB Entry vdb-entry x_refsource_xf
https://exchange.xforce.ibmcloud.com/vulnerabilities/75229
Exploit mailing-list x_refsource_bugtraq
http://archives.neohapsis.com/archives/bugtraq/2012-04/0213.html
Exploit vdb-entry x_refsource_bid
http://www.securityfocus.com/bid/53266
Third Party Advisory, VDB Entry vdb-entry x_refsource_osvdb
http://www.osvdb.org/81561

Scores

EPSS 0.0185
EPSS Percentile 76.3%

Details

CWE
CWE-79
Status published
Products (1)
diy-cms/diy-cms 1.0
Published Jan 24, 2013
Tracked Since Feb 18, 2026