Description
Multiple cross-site scripting (XSS) vulnerabilities in index.php in Vigile CMS 1.8 allow remote attackers to inject arbitrary web script or HTML via a request to the wiki module with (1) the title parameter or (2) a "title=" sequence in the PATH_INFO, or a request to the download module with (3) the cat parameter or (4) a "cat=" sequence in the PATH_INFO.
Public exploits
Exploit or proof-of-concept code for this vulnerability is publicly available, which lowers the bar for attackers. Treat it as a reason to patch sooner.
Third-party code, not reviewed by us. Public PoCs are sometimes fake or contain malware. Read the code first and run it only in an isolated lab, against systems you are authorised to test.
Exploit-DB 1
- Vigile CMS 1.8 Wiki Module - Multiple Cross-Site Scripting Vulnerabilities EDB-30601 · webapps · Sep 20, 2007 · verified
Sources: PoC-in-GitHub, Metasploit Framework, Exploit-DB — updated daily. Only links are listed; no exploit code is hosted here.
References
- 3162 third-party-advisory
- cmsvigile-index-xss(36712) vdb-entry
- 26913 third-party-advisory
- 20070920 Vigile CMS v1.8 Multiple Remote XSS Vulnerability mailing-list
- 25752 vdb-entry