CVE-2012-6708

MEDIUM

jQuery < 1.9.0 - Cross-Site Scripting via jQuery(strInput) Function

Title source: llm

Exploitation Summary

EIP tracks 1 public exploit for CVE-2012-6708. PoCs published by MiningOmerta.

AI-analyzed exploit summary This is a writeup describing a cross-site scripting (XSS) vulnerability in Linksys EA7500 routers due to an outdated jQuery version. The exploit involves injecting malicious JavaScript into the email address field during login.

Description

jQuery before 1.9.0 is vulnerable to Cross-site Scripting (XSS) attacks. The jQuery(strInput) function does not differentiate selectors from HTML in a reliable fashion. In vulnerable versions, jQuery determined whether the input was HTML by looking for the '<' character anywhere in the string, giving attackers more flexibility when attempting to construct a malicious payload. In fixed versions, jQuery only deems the input to be HTML if it explicitly starts with the '<' character, limiting exploitability only to attackers who can control the beginning of a string, which is far less common.

Exploits (1)

exploitdb WRITEUP

by MiningOmerta · textwebappshardware

https://www.exploit-db.com/exploits/49708

View Code ZIP pw:eip

This is a writeup describing a cross-site scripting (XSS) vulnerability in Linksys EA7500 routers due to an outdated jQuery version. The exploit involves injecting malicious JavaScript into the email address field during login.

Classification

Writeup 90%

Attack Type

Xss

Complexity

Trivial

Reliability

Reliable

Target: Linksys EA7500 Firmware Version 2.0.8.194281

No auth needed

Prerequisites: Access to the router's login page

MITRE ATT&CK