CVE-2006-1135
sBlog 0.7.2 - Cross-Site Scripting via Search Keyword or Comments Username
Title source: llmExploitation Summary
EIP tracks 2 public exploits for CVE-2006-1135. PoCs published by Kiki.
AI-analyzed exploit summary This exploit demonstrates an HTML injection vulnerability in sBlog by sending a maliciously crafted POST request to search.php with a script tag payload. The vulnerability allows arbitrary HTML and script code execution in the context of the affected website.
Description
Multiple cross-site scripting (XSS) vulnerabilities in sBlog 0.7.2 allow remote attackers to inject arbitrary web script or HTML via the (1) keyword parameter to search.php or (2) username parameter to comments_do.php.
Exploits (2)
This exploit demonstrates an HTML injection vulnerability in sBlog by sending a maliciously crafted POST request to search.php with a script tag payload. The vulnerability allows arbitrary HTML and script code execution in the context of the affected website.
This exploit demonstrates an HTML injection vulnerability in sBlog, where user-supplied input is not properly sanitized. The provided HTTP POST request injects a script tag to execute arbitrary JavaScript in the context of the affected website.