CVE-2013-4624
Jahia xCM 6.6.1.0 - Cross-Site Scripting via Multiple Parameters
Title source: llmExploitation Summary
EIP tracks 2 public exploits for CVE-2013-4624. PoCs published by High-Tech Bridge.
AI-analyzed exploit summary The provided text describes a cross-site scripting (XSS) vulnerability in Jahia xCM, where user-supplied input is not properly sanitized. The example URL demonstrates an XSS payload that executes arbitrary JavaScript in the context of the affected website.
Description
Multiple cross-site scripting (XSS) vulnerabilities in Jahia xCM 6.6.1.0 before hotfix 7 allow remote attackers to inject arbitrary web script or HTML via (1) the site parameter to engines/manager.jsp, (2) the searchString parameter to administration/ in a search action, or the (3) username, (4) firstName, (5) lastName, (6) email, or (7) organization field to administration/ in a users action.
Exploits (2)
The provided text describes a cross-site scripting (XSS) vulnerability in Jahia xCM, where user-supplied input is not properly sanitized. The example URL demonstrates an XSS payload that executes arbitrary JavaScript in the context of the affected website.
This exploit demonstrates multiple cross-site scripting (XSS) vulnerabilities in Jahia xCM by injecting malicious JavaScript into form inputs. The PoC submits forms with payloads that trigger alert popups with document.cookie, proving arbitrary script execution in the context of the affected website.