medium4.3Public exploit code
CVE-2012-3872
Multiple cross-site scripting (XSS) vulnerabilities in Open Constructor 3.12.0 allow remote attackers to inject arbitrary web script or HTML via (1) the result…
Public exploit code
Working exploit or proof of concept code has been published for this vulnerability. Treat unpatched systems as at risk.
- Open Constructor - 'confirm.php?q' Cross-Site Scripting2012-08-04 · webapps · php · Verified
- Open Constructor - '/data/file/edit.php?result' Cross-Site Scripting2012-08-04 · webapps · php · Verified
- Open Constructor - '/users/users.php?keyword' Cross-Site Scripting2012-08-04 · webapps · php · Verified
Impact
Multiple cross-site scripting (XSS) vulnerabilities in Open Constructor 3.12.0 allow remote attackers to inject arbitrary web script or HTML via (1) the result parameter to data/file/edit.php, (2) the q parameter to confirm.php, or (3) the keyword parameter to users/users.php.
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Openconstructor Project | Openconstructor | Version 3.12.0 |