CVE-2006-0442
MyBB 1.02 - Cross-Site Scripting via usercp.php Notepad and Signature Parameters
Title source: llmExploitation Summary
EIP tracks 1 public exploit for CVE-2006-0442. PoCs published by Roozbeh Afrasiabi.
AI-analyzed exploit summary This exploit demonstrates an HTML injection vulnerability in MyBB due to insufficient input sanitization. The PoC injects a script tag into the 'notepad' parameter, which executes arbitrary JavaScript in the context of the affected site.
Description
Multiple cross-site scripting (XSS) vulnerabilities in usercp.php in MyBulletinBoard (MyBB) 1.02 allow remote attackers to inject arbitrary web script or HTML via the (1) notepad parameter in a notepad action and (2) signature parameter in an editsig action. NOTE: These are different attack vectors, and probably a different vulnerability, than CVE-2006-0218 and CVE-2006-0219.
Exploits (1)
This exploit demonstrates an HTML injection vulnerability in MyBB due to insufficient input sanitization. The PoC injects a script tag into the 'notepad' parameter, which executes arbitrary JavaScript in the context of the affected site.