Exploitation Summary
EIP tracks 1 public exploit for CVE-2014-8775. PoCs published by Narendra Bhati.
AI-analyzed exploit summary This advisory details multiple vulnerabilities in MODX Revolution, including CSRF token bypass, reflected XSS via the 'context_key' parameter, and stored XSS via the 'context' parameter. The writeup provides exploitation examples but does not include functional exploit code.
Description
MODX Revolution 2.x before 2.2.15 does not include the HTTPOnly flag in a Set-Cookie header for the session cookie, which makes it easier for remote attackers to obtain potentially sensitive information via script access to this cookie.
Exploits (1)
This advisory details multiple vulnerabilities in MODX Revolution, including CSRF token bypass, reflected XSS via the 'context_key' parameter, and stored XSS via the 'context' parameter. The writeup provides exploitation examples but does not include functional exploit code.