medium4.3Public exploit code
CVE-2009-3360
Multiple cross-site scripting (XSS) vulnerabilities in Datemill 1.0 allow remote attackers to inject arbitrary web script or HTML via the (1) return parameter …
Public exploit code
Working exploit or proof of concept code has been published for this vulnerability. Treat unpatched systems as at risk.
- Datemill - 'search.php?st' Cross-Site Scripting2009-09-10 · webapps · php · Verified
- Datemill - 'photo_search.php?st' Cross-Site Scripting2009-09-10 · webapps · php · Verified
- Datemill - 'photo_view.php?return' Cross-Site Scripting2009-09-10 · webapps · php · Verified
Impact
Multiple cross-site scripting (XSS) vulnerabilities in Datemill 1.0 allow remote attackers to inject arbitrary web script or HTML via the (1) return parameter to photo_view.php, and st parameter to (2) photo_search.php and (3) search.php.
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Datemill | Datemill | Version 1.0 |
Weakness classification
References
- NVD record
- CVE.org record
- http://osvdb.org/57989
- http://osvdb.org/57991
- http://packetstormsecurity.org/0909-exploits/datemill-xss.txt
- http://secunia.com/advisories/36608
- http://www.osvdb.org/57990
- https://exchange.xforce.ibmcloud.com/vulnerabilities/53177
- http://osvdb.org/57989
- http://osvdb.org/57991
- http://packetstormsecurity.org/0909-exploits/datemill-xss.txt
- http://secunia.com/advisories/36608
- http://www.osvdb.org/57990
- https://exchange.xforce.ibmcloud.com/vulnerabilities/53177