CVE-2005-3902

Virtual Hosting Control System 2.2.0-2.4.6.2 - Cross-Site Scripting via Error Message Query String

Title source: llm

Exploitation Summary

EIP tracks 1 public exploit for CVE-2005-3902. PoCs published by Moritz Naumann.

AI-analyzed exploit summary The exploit describes a cross-site scripting (XSS) vulnerability in Virtual Hosting Control System where error messages are not properly sanitized, allowing attackers to inject malicious script code. The provided URL demonstrates a proof-of-concept XSS payload.

Description

Cross-site scripting (XSS) vulnerability in gui/errordocs/index.php in Virtual Hosting Control System (VHCS) 2.2.0 through 2.4.6.2 allows remote attackers to inject arbitrary web script or HTML via query strings that are included in an error message, as demonstrated using a parameter containing script.

Exploits (1)

exploitdb WRITEUP VERIFIED

by Moritz Naumann · textwebappsphp

https://www.exploit-db.com/exploits/26559

View Code ZIP pw:eip

The exploit describes a cross-site scripting (XSS) vulnerability in Virtual Hosting Control System where error messages are not properly sanitized, allowing attackers to inject malicious script code. The provided URL demonstrates a proof-of-concept XSS payload.

Classification

Writeup 90%

Attack Type

Xss

Complexity

Trivial

Reliability

Reliable

Target: Virtual Hosting Control System

No auth needed

Prerequisites: Access to a vulnerable instance of Virtual Hosting Control System

MITRE ATT&CK