CVE-2012-0873

23Vexday Risk Score

No sign of exploitation. It has a public proof of concept.

ssvc Attendepss 4.3%

from disclosure to weapon0 days

Published on NVDFeb 23

1st PoCFeb 21

exploitation probability

4.3%top 10% of all CVEs

observed exploitation

nono source reports it

2 public exploit(s)

Multiple cross-site scripting (XSS) vulnerabilities in Boonex Dolphin before 7.0.8 allow remote attackers to inject arbitrary web script or HTML via the (1) explain parameter to explanation.php or the (2) photos_only, (3) online_only, or (4) mode parameters to viewFriends.php.

Affected products

n/a · n/a

public PoCs found — 2✓ VexDay Proof

exploitdb✓ VexDay Proofwww.exploit-db.com/exploits/36854 exploitdb✓ VexDay Proofwww.exploit-db.com/exploits/36853

⚠ Public resources, to assess the exposure of systems you control or are authorized to test. Test only with authorization.

References

http://archives.neohapsis.com/archives/bugtraq/2012-02/0107.html http://www.boonex.com/n/dolphin-7-0-8-released http://www.boonex.com/trac/dolphin/changeset/15282 http://www.boonex.com/trac/dolphin/changeset/15283 http://www.boonex.com/trac/dolphin/ticket/2530 http://www.openwall.com/lists/oss-security/2012/02/20/11 http://www.openwall.com/lists/oss-security/2012/02/20/6 http://www.securityfocus.com/bid/52088 http://yehg.net/lab/pr0js/advisories/%5BDolphin_7.0.7%5D_xss