CVE-2014-9146
Fiyo CMS 2.0.1.8 - Cross-Site Scripting via Multiple URI Parameters
Title source: llmExploitation Summary
EIP tracks 1 public exploit for CVE-2014-9146.
AI-analyzed exploit summary The provided exploit demonstrates multiple SQL injection vulnerabilities in FiyoCMS 2.0.1.8, including UNION-based, error-based, and time-based blind SQLi. It includes specific payloads and Sqlmap outputs for parameters like 'id', 'cat', 'user', and 'level'.
Description
Multiple cross-site scripting (XSS) vulnerabilities in Fiyo CMS 2.0.1.8 allow remote attackers to inject arbitrary web script or HTML via the (1) view, (2) id, (3) page, or (4) app parameter to the default URI or the (5) act parameter to dapur/index.php.
Exploits (1)
The provided exploit demonstrates multiple SQL injection vulnerabilities in FiyoCMS 2.0.1.8, including UNION-based, error-based, and time-based blind SQLi. It includes specific payloads and Sqlmap outputs for parameters like 'id', 'cat', 'user', and 'level'.