CVE-2005-0670
phpCOIN 1.2.0-1.2.1b - Cross-Site Scripting via mod.php and login.php Parameters
Title source: llmExploitation Summary
EIP tracks 2 public exploits for CVE-2005-0670. PoCs published by Lostmon.
AI-analyzed exploit summary The exploit demonstrates XSS vulnerabilities in phpCOIN by injecting JavaScript via URL parameters. It targets the 'helpdesk' and 'mail' modules, allowing arbitrary script execution in the context of a user's browser session.
Description
Cross-site scripting (XSS) vulnerability in phpCOIN 1.2.0 through 1.2.1b allows remote attackers to inject arbitrary web script or HTML via (1) the new parameter to mod.php, (2) the w parameter to mod.php, (3) the e parameter to login.php, (4) the o parameter to login.php, and possibly other scripts.
Exploits (2)
The exploit demonstrates XSS vulnerabilities in phpCOIN by injecting JavaScript via URL parameters. It targets the 'helpdesk' and 'mail' modules, allowing arbitrary script execution in the context of a user's browser session.
This exploit demonstrates a cross-site scripting (XSS) vulnerability in phpCOIN by injecting malicious JavaScript into the 'e' parameter of the login.php page. The payload extracts and displays the user's cookies, confirming the vulnerability.