CVE-2006-0800
PostNuke <= 0.761 - Cross-Site Scripting via HTML Tag Trailing '<' Bypass
Title source: llmExploitation Summary
EIP tracks 1 public exploit for CVE-2006-0800. PoCs published by Maksymilian Arciemowicz.
AI-analyzed exploit summary The provided text describes input-validation vulnerabilities in PostNuke, specifically in the 'NS-Languages' module, which could lead to various attacks such as XSS or data manipulation. It includes example URLs demonstrating potential exploitation vectors.
Description
Interpretation conflict in PostNuke 0.761 and earlier allows remote attackers to conduct cross-site scripting (XSS) attacks via HTML tags with a trailing "<" character, which is interpreted as a ">" character by some web browsers but bypasses the blacklist protection in (1) the pnVarCleanFromInput function in pnAPI.php, (2) the pnSecureInput function in pnAntiCracker.php, and (3) the htmltext parameter in an edituser operation to user.php.
Exploits (1)
The provided text describes input-validation vulnerabilities in PostNuke, specifically in the 'NS-Languages' module, which could lead to various attacks such as XSS or data manipulation. It includes example URLs demonstrating potential exploitation vectors.