CVE-2005-2064
ASP Nuke 0.80 - Cross-Site Scripting via Multiple Registration Parameters
Title source: llmExploitation Summary
EIP tracks 2 public exploits for CVE-2005-2064. PoCs published by Alberto Trivero.
AI-analyzed exploit summary This exploit demonstrates multiple XSS vulnerabilities in ASPNuke by injecting arbitrary JavaScript code via unsanitized input parameters in the registration form. The PoC URLs trigger script execution in the context of the affected site, potentially stealing cookies or performing other client-side attacks.
Description
Multiple cross-site scripting vulnerabilities in ASP Nuke 0.80 allow remote attackers to inject arbitrary web script or HTML via the (1) email parameter to forgot_password.asp, or the (2) FirstName, (3) LastName, (4) Username, (5) Password, (6) Address1, (7) Address2, (8) City, (9) ZipCode, (10) Email parameter to register.asp.
Exploits (2)
This exploit demonstrates multiple XSS vulnerabilities in ASPNuke by injecting arbitrary JavaScript code via unsanitized input parameters in the registration form. The PoC URLs trigger script execution in the context of the affected site, potentially stealing cookies or performing other client-side attacks.
This exploit demonstrates a cross-site scripting (XSS) vulnerability in ASPNuke by injecting arbitrary JavaScript code via the 'email' parameter in the forgot_password.asp page. The PoC uses a simple alert to display the user's cookies, proving the vulnerability.