CVE-2017-9934
MEDIUMJoomla! 1.7.3-3.7.2 - Cross-Site Scripting via Missing CSRF Token Checks
Title source: llmExploitation Summary
EIP tracks 1 public exploit for CVE-2017-9934. PoCs published by xyringe.
AI-analyzed exploit summary This PoC demonstrates a CSRF vulnerability in Joomla 1.7.3 to 3.7.2, where unsanitized base64 input in the 'jform[type]' parameter leads to XSS via a crafted JSON payload. The exploit triggers an error message that renders the malicious script without sanitization.
Description
Missing CSRF token checks and improper input validation in Joomla! CMS 1.7.3 through 3.7.2 lead to an XSS vulnerability.
Exploits (1)
This PoC demonstrates a CSRF vulnerability in Joomla 1.7.3 to 3.7.2, where unsanitized base64 input in the 'jform[type]' parameter leads to XSS via a crafted JSON payload. The exploit triggers an error message that renders the malicious script without sanitization.
References (3)
Scores
CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N