CVE-2008-6325

Public exploit code

Working exploit or proof of concept code has been published for this vulnerability. Treat unpatched systems as at risk.

• Softbiz Classifieds Script - '/admin/index.php?msg' Cross-Site Scripting2008-12-01 · webapps · php · Verified
• Softbiz Classifieds Script - '/admin/adminhome.php?msg' Cross-Site Scripting2008-12-01 · webapps · php · Verified
• Softbiz Classifieds Script - 'lostpassword.php?msg' Cross-Site Scripting2008-12-01 · webapps · php · Verified
• Softbiz Classifieds Script - 'gallery.php?radio' Cross-Site Scripting2008-12-01 · webapps · php · Verified
• Softbiz Classifieds Script - '/advertisers/signinform.php?msg' Cross-Site Scripting2008-12-01 · webapps · php · Verified
• Softbiz Classifieds Script - 'showcategory.php?radio' Cross-Site Scripting2008-12-01 · webapps · php · Verified

Impact

Multiple cross-site scripting (XSS) vulnerabilities in Softbiz Classifieds Script allow remote attackers to inject arbitrary web script or HTML via the (1) radio parameter to showcategory.php, (2) msg parameter to advertisers/signinform.php, (3) radio parameter to gallery.php, (4) msg parameter to lostpassword.php, (5) radio parameter to showcategory.php, (6) msg parameter to admin/adminhome.php, and (7) msg parameter to admin/index.php. NOTE: a different signinform.php file is already covered by CVE-2008-6306.

Affected products

Weakness classification

References

• NVD record
• CVE.org record
• http://packetstorm.linuxsecurity.com/0812-exploits/classifieds-xss.txt
• http://secunia.com/advisories/32828
• http://www.securityfocus.com/bid/32569
• https://exchange.xforce.ibmcloud.com/vulnerabilities/47008
• http://packetstorm.linuxsecurity.com/0812-exploits/classifieds-xss.txt
• http://secunia.com/advisories/32828
• http://www.securityfocus.com/bid/32569
• https://exchange.xforce.ibmcloud.com/vulnerabilities/47008