CVE-2008-5939 Cross-site scripting (XSS) vulnerability in index.php in MODx CMS 0.9.6.2 and earlier allows remote attackers to inject arbitrary web script or HTML via a JavaScript event in the username field, possi...
MediumCVSS 4.3
EPSS 1.7%
Public exploit
- Published
- Updated
- Exploit status
- Public exploit available
Description
Cross-site scripting (XSS) vulnerability in index.php in MODx CMS 0.9.6.2 and earlier allows remote attackers to inject arbitrary web script or HTML via a JavaScript event in the username field, possibly related to snippet.ditto.php. NOTE: some sources list the id parameter as being affected, but this is probably incorrect based on the original disclosure.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| modxcms | <= 0.9.6.2 | No fix listed |
| modxcms | = 0.9.0 | No fix listed |
| modxcms | = 0.9.1 | No fix listed |
| modxcms | = 0.9.2.1 | No fix listed |
| modxcms | = 0.9.5 | No fix listed |
| modxcms | = 0.9.6 | No fix listed |
| modxcms | = 0.9.6.1 | No fix listed |
References
- 4940 third-party-advisory
- svn.modxcms.com
- 32436 exploit vdb-entry
- ADV-2008-3236 vdb-entry
- modx-index-id-xss(46796) vdb-entry
- 7204 exploit