medium4.3Public exploit code
CVE-2008-7036
Multiple cross-site scripting (XSS) vulnerabilities in index.php in DevTracker module 3.0 for bcoos 1.1.11 and earlier, and DevTracker module 0.20 for E-XooPS …
Public exploit code
Working exploit or proof of concept code has been published for this vulnerability. Treat unpatched systems as at risk.
- DevTracker Module For bcoos 1.1.11 and E-xoops 1.0.8 - Multiple Cross-Site Scripting Vulnerabilities2008-02-04 · webapps · php · Verified
Impact
Multiple cross-site scripting (XSS) vulnerabilities in index.php in DevTracker module 3.0 for bcoos 1.1.11 and earlier, and DevTracker module 0.20 for E-XooPS 1.0.8 and earlier, allow remote attackers to inject arbitrary web script or HTML via the (1) direction and (2) order_by parameters.
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| E-Xoops | E-Xoops | through 1.08 Version 1.05 |
| Bcoos | Devtracker | Versions 0.20, 3.0 |
| Bcoos | Bcoos | through 1.1.11 Versions 1.0.9, 1.0.10, 1.0.11, 1.0.12, 1.0.13 |
Weakness classification
References
- NVD record
- CVE.org record
- http://lostmon.blogspot.com/2008/02/bcoos-and-e-xoops-devtracker-module-two.html
- http://osvdb.org/44334
- http://osvdb.org/44335
- http://www.securityfocus.com/bid/27619
- https://exchange.xforce.ibmcloud.com/vulnerabilities/40306
- http://lostmon.blogspot.com/2008/02/bcoos-and-e-xoops-devtracker-module-two.html
- http://osvdb.org/44334
- http://osvdb.org/44335
- http://www.securityfocus.com/bid/27619
- https://exchange.xforce.ibmcloud.com/vulnerabilities/40306