EDB-7075

functional

Openfire Server 3.6.0a - Authentication Bypass / SQL Injection / Cross-Site Scripting

view exploit source exploit_dbverifiedtype webappsauthor Andreas Kurtzpublished 2008-11-09catalog exploit_db

exploited CVEs (4)

Known CVEs related to this entry.

ID	severity	EPSS	exploitable	published
CVE-2008-6511US	medium5.8	1.83% (79th)	Exploit	2009-03-23
Open redirect vulnerability in login.jsp in Openfire 3.6.0a and earlier allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via the url pa…
CVE-2008-6510US	medium4.3	1.78% (78th)	Exploit	2009-03-23
Cross-site scripting (XSS) vulnerability in login.jsp in the Admin Console in Openfire 3.6.0a and earlier allows remote attackers to inject arbitrary web script or HTML via the url…
CVE-2008-6509US	high7.5	2.01% (81st)	Exploit	2009-03-23
SQL injection vulnerability in CallLogDAO in SIP Plugin in Openfire 3.6.0a and earlier allows remote attackers to execute arbitrary SQL commands via the type parameter to sipark-lo…
CVE-2008-6508US	high7.5	83.7% (100th)	Exploit	2009-03-23
Directory traversal vulnerability in the AuthCheck filter in the Admin Console in Openfire 3.6.0a and earlier allows remote attackers to bypass authentication and access the admin…

scry

Working exploits like this target internet-facing systems. See what is exposed on your perimeter with a free passive scan.