CVE-2005-1030
Active Auction House - Stored Cross-Site Scripting via Multiple Parameters
Title source: llmExploitation Summary
EIP tracks 4 public exploits for CVE-2005-1030. PoCs published by Dcrab.
AI-analyzed exploit summary This exploit demonstrates a cross-site scripting (XSS) vulnerability in Active Auction House by injecting a script tag into the 'itemid' parameter of the 'watchthisitem.asp' page. The script executes arbitrary JavaScript, potentially stealing cookies or performing other malicious actions in the context of the user's session.
Description
Multiple cross-site scripting (XSS) vulnerabilities in Active Auction House allow remote attackers to inject arbitrary web script or HTML via the (1) ReturnURL, (2) password, (3) username parameter, (4) ReturnURL parameter to account.asp, (5) Table, (6) Title parameter to sendpassword.asp, or (7) itemid to watchthisitem.asp.
Exploits (4)
This exploit demonstrates a cross-site scripting (XSS) vulnerability in Active Auction House by injecting a script tag into the 'itemid' parameter of the 'watchthisitem.asp' page. The script executes arbitrary JavaScript, potentially stealing cookies or performing other malicious actions in the context of the user's session.
This exploit demonstrates a cross-site scripting (XSS) vulnerability in Active Auction House by injecting arbitrary script code via unsanitized user input in the username and password parameters.
This exploit demonstrates cross-site scripting (XSS) vulnerabilities in Active Auction House by injecting arbitrary script code via unsanitized input parameters in the sendpassword.asp page. The PoC uses script tags to execute JavaScript in the context of a user's browser.
The provided text describes a cross-site scripting (XSS) vulnerability in Active Auction House, where user-supplied input is not properly sanitized. The example URL demonstrates how arbitrary script code can be executed in a user's browser.