CVE-2013-4889
Digital Signage Xibo 1.4.2 - Cross-Site Request Forgery in index.php
Title source: llmExploitation Summary
EIP tracks 1 public exploit for CVE-2013-4889. PoCs published by Jacob Holcomb.
AI-analyzed exploit summary This HTML-based exploit demonstrates a CSRF vulnerability in Xibo 1.4.2, allowing an attacker to add a super user and inject XSS payloads via crafted form submissions. The PoC automates the process using JavaScript to submit malicious requests to the target application.
Description
Multiple cross-site request forgery (CSRF) vulnerabilities in index.php in Digital Signage Xibo 1.4.2 allow remote attackers to hijack the authentication of administrators for requests that (1) add a new administrator via the AddUser action or (2) conduct cross-site scripting (XSS) attacks, as demonstrated by CVE-2013-4888.
Exploits (1)
This HTML-based exploit demonstrates a CSRF vulnerability in Xibo 1.4.2, allowing an attacker to add a super user and inject XSS payloads via crafted form submissions. The PoC automates the process using JavaScript to submit malicious requests to the target application.