medium4.3Public exploit code
CVE-2008-5264
Cross-site scripting (XSS) vulnerability in searcher.exe in Tornado Knowledge Retrieval System 4.2 and earlier allows remote attackers to inject arbitrary web …
Public exploit code
Working exploit or proof of concept code has been published for this vulnerability. Treat unpatched systems as at risk.
- Tornado Knowledge Retrieval System 4.2 - 'p' Cross-Site Scripting2008-06-10 · webapps · cgi · Verified
Impact
Cross-site scripting (XSS) vulnerability in searcher.exe in Tornado Knowledge Retrieval System 4.2 and earlier allows remote attackers to inject arbitrary web script or HTML via the p parameter in a root action.
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Tornado | Tornado Knowledge Retrieval System | through 4.2 |
Weakness classification
References
- NVD record
- CVE.org record
- http://secunia.com/advisories/30623
- http://securityreason.com/securityalert/4655
- http://www.securityfocus.com/archive/1/493217/100/0/threaded
- http://www.securityfocus.com/bid/29626
- https://exchange.xforce.ibmcloud.com/vulnerabilities/42963
- http://secunia.com/advisories/30623
- http://securityreason.com/securityalert/4655
- http://www.securityfocus.com/archive/1/493217/100/0/threaded
- http://www.securityfocus.com/bid/29626
- https://exchange.xforce.ibmcloud.com/vulnerabilities/42963