CVE-2006-0894
NOCC Webmail 1.0 - Cross-Site Scripting via Multiple Parameters
Title source: llmExploitation Summary
EIP tracks 4 public exploits for CVE-2006-0894. PoCs published by rgod.
AI-analyzed exploit summary The provided text describes a vulnerability in NOCC Webmail involving input-validation issues leading to arbitrary PHP code injection and XSS. It includes a sample XSS payload but lacks executable exploit code.
Description
Multiple cross-site scripting (XSS) vulnerabilities in NOCC Webmail 1.0 allow remote attackers to inject arbitrary web script or HTML via (1) the html_error_occurred parameter in error.php, (2) html_filter_select parameter in filter_prefs.php, (3) html_no_mail parameter in no_mail.php, the (4) page_line, (5) prev, and (6) next parameters in html_bottom_table.php, and the (7) _SESSION['nocc_theme'] parameter in footer.php.
Exploits (4)
The provided text describes a vulnerability in NOCC Webmail involving input-validation issues leading to arbitrary PHP code injection and XSS. It includes a sample XSS payload but lacks executable exploit code.
This exploit demonstrates XSS vulnerabilities in NOCC Webmail due to improper input sanitization. The PoC provides URLs that inject arbitrary JavaScript code via the 'page_line', 'prev', and 'next' parameters.
The provided text describes a vulnerability in NOCC Webmail related to input validation failures, allowing for arbitrary PHP code injection and XSS attacks. It includes a sample XSS payload but lacks executable exploit code.
The provided text describes a vulnerability in NOCC Webmail involving input-validation issues leading to arbitrary PHP code injection and XSS. It includes a sample XSS payload but lacks executable exploit code.