CVE-2013-5020
MiniBB < 3.0.1 - Cross-Site Scripting via forum_name, forum_group, forum_icon, or forum_desc Parameter
Title source: llmExploitation Summary
EIP tracks 1 public exploit for CVE-2013-5020. PoCs published by Netsparker.
AI-analyzed exploit summary The exploit demonstrates SQL injection vulnerabilities in miniBB 3.0.0 via unsanitized parameters in multiple functions, allowing attackers to extract sensitive data like MySQL version and admin credentials.
Description
Multiple cross-site scripting (XSS) vulnerabilities in bb_admin.php in MiniBB before 3.0.1 allow remote attackers to inject arbitrary web script or HTML via the (1) forum_name, (2) forum_group, (3) forum_icon, or (4) forum_desc parameter. NOTE: the whatus vector is already covered by CVE-2008-2066.
Exploits (1)
The exploit demonstrates SQL injection vulnerabilities in miniBB 3.0.0 via unsanitized parameters in multiple functions, allowing attackers to extract sensitive data like MySQL version and admin credentials.