CVE-2005-2674
Land Down Under 800 - Cross-Site Scripting via c, m, or w Parameters
Title source: llmExploitation Summary
EIP tracks 2 public exploits for CVE-2005-2674. PoCs published by bl2k.
AI-analyzed exploit summary This exploit demonstrates a cross-site scripting (XSS) vulnerability in Land Down Under by injecting arbitrary JavaScript code via the 'w' parameter in the journal.php URL. The PoC uses a simple alert dialog to confirm the vulnerability.
Description
Note: the vendor has disputed this issue. Multiple cross-site scripting (XSS) vulnerabilities in Land Down Under (LDU) 800 allow remote attackers to inject arbitrary web script or HTML via the (1) c or (2) m parameters to index.php or (3) w parameter to journal.php. NOTE: this issue has been disputed by the vendor, who says "None of the tricks written there are working, the variables are properly sanitized and no LDU version is affected.
Exploits (2)
This exploit demonstrates a cross-site scripting (XSS) vulnerability in Land Down Under by injecting arbitrary JavaScript code via the 'w' parameter in the journal.php URL. The PoC uses a simple alert dialog to confirm the vulnerability.
This exploit demonstrates multiple cross-site scripting (XSS) vulnerabilities in Land Down Under by injecting arbitrary script code via unsanitized input parameters. The PoC provides example URLs with malicious payloads.