CVE-2005-3959
FreeWebStat 1.0 rev37 - Cross-Site Scripting via site, jsref, jsres, jscolor, and search Parameters
Title source: llmExploitation Summary
EIP tracks 1 public exploit for CVE-2005-3959. PoCs published by Francesco Ongaro.
AI-analyzed exploit summary The exploit demonstrates multiple XSS vulnerabilities in FreeWebStat by injecting arbitrary JavaScript via unsanitized input parameters (domain, site, jsref, jsres, jscolor). The PoC uses curl commands to trigger the vulnerabilities, confirming the lack of input validation.
Description
Multiple cross-site scripting (XSS) vulnerabilities in FreeWebStat 1.0 rev37 allow remote attackers to inject arbitrary web script or HTML via the (1) site, (2) jsref, (3) jsres, and (4) jscolor parameters to pixel.php, which are not sanitized before being included in the logdb.html file, and (5) the search key to stat.php.
Exploits (1)
The exploit demonstrates multiple XSS vulnerabilities in FreeWebStat by injecting arbitrary JavaScript via unsanitized input parameters (domain, site, jsref, jsres, jscolor). The PoC uses curl commands to trigger the vulnerabilities, confirming the lack of input validation.