CVE-2008-1556

Multiple cross-site scripting (XSS) vulnerabilities in BolinOS 4.6.1 allow remote attackers to inject arbitrary web script or HTML via the (1) url parameter to (a) system/actionspages/_b/contentFiles/gBImageViewer.php, (2) ForEditor parameter to (b) system/actionspages/_b/contentFiles/gBselectorContents.php, (3) the PATH_INFO to (c) gBLoginPage.php and (d) gBPassword.php in system/actionspages/_b/contentFiles/, (4) formlogin parameter to system/actionspages/_b/contentFiles/gBLoginPage.php, and the (5) bolini_searchengine46Search parameter to (e) help/index.php.

CVSS v2.0

4.3 MEDIUMAV:N/AC:M/Au:N/C:N/I:P/A:N

EPSS

1.80% chance of exploitation in the next 30 days, 77th percentile

Published

2008-03-31

Updated

2024-08-07

ExploitDB entries (1)

• https://www.exploit-db.com/exploits/5309

References

• CVE Record
• NVD entry

Related

• CVE-2008-1555
• CVE-2008-1557
• CVE-2008-1554
• CVE-2008-1558
• CVE-2008-1553
• CVE-2008-1559