CVE-2008-7242 Multiple cross-site scripting (XSS) vulnerabilities in MODx CMS 0.9.6.1 and 0.9.6.1p1 allo remote attackers to inject arbitrary web script or HTML via the (1) search, (2) "a," (3) messagesubject, and....
MediumCVSS 4.3
EPSS 1.5%
Public exploit
- Published
- Updated
- Exploit status
- Public exploit available
Description
Multiple cross-site scripting (XSS) vulnerabilities in MODx CMS 0.9.6.1 and 0.9.6.1p1 allo remote attackers to inject arbitrary web script or HTML via the (1) search, (2) "a," (3) messagesubject, and (4) messagebody parameters to certain pages as reachable from manager/index.php; (5) highlight, (6) id, (7) email, (8) name, and (9) parent parameters to index.php; and the (10) docgrp and (11) moreResultsPage parameters to index-ajax.php.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| modxcms | = 0.9.6.1 | No fix listed |
| modxcms | = 0.9.6.1-p1 | No fix listed |
References
- 41232 vdb-entry
- 28840 third-party-advisory vendor-advisory
- 20080207 [DSECRG-08-013] Modx 0.9.6.1, 0.9.6.1p1 Multiple Security Vulnerabilities mailing-list
- 27672 exploit vdb-entry
- modx-index-multiple-xss(40375) vdb-entry