CVE-2008-6891
published 2009-08-03CVE-2008-6891: Multiple cross-site scripting (XSS) vulnerabilities in ASP Forum Script allow remote attackers to inject arbitrary web script or HTML via the (1) forum_id…
PriorityP419medium4.3CVSS 2.0
AVNACMAuNCNIPAN
EXPLOIT
EPSS
1.47%
70.5th percentile
Multiple cross-site scripting (XSS) vulnerabilities in ASP Forum Script allow remote attackers to inject arbitrary web script or HTML via the (1) forum_id parameter to (a) new_message.asp and (b) messages.asp, and the (2) query string to default.asp.
CVEs like this are exactly what “Exploited This Week” covers.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
No detection rules found.
Exploit-DB
ASP Forum Script - 'default.asp' Query String Cross-Site Scripting
exploitdb·2008-12-01
CVE-2008-6891 ASP Forum Script - 'default.asp' Query String Cross-Site Scripting
ASP Forum Script - 'default.asp' Query String Cross-Site Scripting
---
source: https://www.securityfocus.com/bid/32571/info
ASP Forum Script is prone to an SQL-injection vulnerability and multiple cross-site scripting vulnerabilities because it fails to sufficiently sanitize user-supplied data.
Exploiting these issues could allow an attacker to steal cookie-based authentication credentials, compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database.
http://www.example.com/[Path]/default.asp?>"'>alert(1369)
Exploit-DB
ASP Forum Script - 'messages.asp?forum_id' Cross-Site Scripting
exploitdb·2008-12-01
CVE-2008-6891 ASP Forum Script - 'messages.asp?forum_id' Cross-Site Scripting
ASP Forum Script - 'messages.asp?forum_id' Cross-Site Scripting
---
source: https://www.securityfocus.com/bid/32571/info
ASP Forum Script is prone to an SQL-injection vulnerability and multiple cross-site scripting vulnerabilities because it fails to sufficiently sanitize user-supplied data.
Exploiting these issues could allow an attacker to steal cookie-based authentication credentials, compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database.
http://www.example.com/[Path]/messages.asp?forum_id=>'>alert(1369)%3B&message_id=197
Exploit-DB
ASP Forum Script - 'new_message.asp?forum_id' Cross-Site Scripting
exploitdb·2008-12-01
CVE-2008-6891 ASP Forum Script - 'new_message.asp?forum_id' Cross-Site Scripting
ASP Forum Script - 'new_message.asp?forum_id' Cross-Site Scripting
---
source: https://www.securityfocus.com/bid/32571/info
ASP Forum Script is prone to an SQL-injection vulnerability and multiple cross-site scripting vulnerabilities because it fails to sufficiently sanitize user-supplied data.
Exploiting these issues could allow an attacker to steal cookie-based authentication credentials, compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database.
http://www.example.com/[Path]/new_message.asp?topic_id=0&message_id=0&forum_id=
No writeups or analysis indexed.
http://packetstormsecurity.org/0812-exploits/aspforum-cmsqlxss.txthttp://www.securityfocus.com/bid/32571https://exchange.xforce.ibmcloud.com/vulnerabilities/47002http://packetstormsecurity.org/0812-exploits/aspforum-cmsqlxss.txthttp://www.securityfocus.com/bid/32571https://exchange.xforce.ibmcloud.com/vulnerabilities/47002
2009-08-03
Published