CVE-2014-9243

WebsiteBaker 2.8.3 - Cross-Site Scripting via QUERY_STRING or section_id Parameter

Title source: llm
STIX 2.1

Exploitation Summary

EIP tracks 1 public exploit for CVE-2014-9243. PoCs published by Manuel García Cárdenas.

AI-analyzed exploit summary This is a vulnerability advisory detailing multiple issues in WebsiteBaker 2.8.3, including SQL injection, XSS, and HTTP response splitting. It provides proof-of-concept URLs and payloads but does not include executable exploit code.

Description

Multiple cross-site scripting (XSS) vulnerabilities in WebsiteBaker 2.8.3 allow remote attackers to inject arbitrary web script or HTML via the (1) QUERY_STRING to wb/admin/admintools/tool.php or (2) section_id parameter to edit_module_files.php, (3) news/add_post.php, (4) news/modify_group.php, (5) news/modify_post.php, or (6) news/modify_settings.php in wb/modules/.

Exploits (1)

exploitdb WRITEUP
by Manuel García Cárdenas · textwebappsphp
https://www.exploit-db.com/exploits/35277

This is a vulnerability advisory detailing multiple issues in WebsiteBaker 2.8.3, including SQL injection, XSS, and HTTP response splitting. It provides proof-of-concept URLs and payloads but does not include executable exploit code.

Classification
Writeup 100%
Attack Type
Sqli | Xss | Other
Complexity
Trivial
Reliability
Reliable
Target: WebsiteBaker <= 2.8.3
No auth needed
Prerequisites: Access to the target application
devstral-2 · analyzed Feb 16, 2026 Full analysis →

References (2)

Core 2

Scores

EPSS 0.0248
EPSS Percentile 82.5%

Details

CWE
CWE-79
Status published
Products (1)
websitebaker/websitebaker 2.8.3
Published Dec 03, 2014
Tracked Since Feb 18, 2026