CVE-2008-6848

Vulnerability

The vulnerability is a reflected cross-site scripting (XSS) issue in phpGreetCards version 3.7. The index.php script does not properly sanitize the category parameter when the mode is set to select. An attacker can inject arbitrary JavaScript or HTML into the page. Affected version: phpGreetCards 3.7. [1]

Exploitation

An attacker can exploit this by crafting a URL such as index.php?mode=select&category=>" and tricking a user into clicking it. No authentication is required; the attacker only needs to convince a victim to visit the malicious link. [1]

Impact

Successful exploitation allows the attacker to execute arbitrary script in the context of the victim's browser, potentially leading to session hijacking, defacement, or theft of sensitive information. The impact is limited to the client side.

Mitigation

No official patch or fixed version has been identified in the available references. Users should consider upgrading to a newer version if available, or implement input validation and output encoding for the category parameter. The software may be end-of-life. [1]