CVE-2014-2090
ILIAS 4.4.1 - Authenticated Cross-Site Scripting via tar, tar_val, or title Parameter
Title source: llmExploitation Summary
EIP tracks 1 public exploit for CVE-2014-2090. PoCs published by HauntIT.
AI-analyzed exploit summary This exploit demonstrates multiple vulnerabilities in ILIAS 4.4.1, including persistent XSS, arbitrary file upload leading to webshell deployment, and reflected XSS. The PoC provides HTTP requests to exploit these flaws, allowing attackers to execute arbitrary code or inject malicious scripts.
Description
Multiple cross-site scripting (XSS) vulnerabilities in ilias.php in ILIAS 4.4.1 allow remote authenticated users to inject arbitrary web script or HTML via the (1) tar, (2) tar_val, or (3) title parameter.
Exploits (1)
This exploit demonstrates multiple vulnerabilities in ILIAS 4.4.1, including persistent XSS, arbitrary file upload leading to webshell deployment, and reflected XSS. The PoC provides HTTP requests to exploit these flaws, allowing attackers to execute arbitrary code or inject malicious scripts.