CVE-2006-1205
myWebland myBloggie 2.1.3 beta - Cross-Site Scripting via Multiple Parameters
Title source: llmExploitation Summary
EIP tracks 10 public exploits for CVE-2006-1205. PoCs published by [email protected].
AI-analyzed exploit summary The provided text describes a cross-site scripting (XSS) vulnerability in MyBloggie 2.1.3 beta, where user-supplied input is not properly sanitized in the 'del' and 'message' parameters of the admin.php script. This allows arbitrary script execution in the context of the affected site.
Description
Multiple cross-site scripting (XSS) vulnerabilities in myWebland myBloggie 2.1.3 beta and earlier allow remote attackers to inject arbitrary web script or HTML via the (1) confirmredirect and (2) post_id parameters in (a) delcomment.php, as reachable when mode=delcom from index.php; and the (3) del and (4) message parameters in (b) upload.php, the (5) errormsg parameter in (c) addcat.php, (d) edituser.php, (e) adduser.php, and (f) editcat.php, the (6) trackback_url parameter in (g) add.php, (7) id parameter in (h) deluser.php, (8) cat_id parameter in (i) delcat.php, and (9) post_id parameter in (j) del.php, as reachable from admin.php.
Exploits (10)
The provided text describes a cross-site scripting (XSS) vulnerability in MyBloggie 2.1.3 beta, where user-supplied input is not properly sanitized in the 'del' and 'message' parameters of the admin.php script. This allows arbitrary script execution in the context of the affected site.
This exploit demonstrates a stored XSS vulnerability in MyBloggie 2.1.3 beta by injecting a malicious script via the 'trackback_url' parameter. The PoC automatically submits a form with the payload, triggering the XSS when processed by the application.
This exploit demonstrates a stored XSS vulnerability in MyBloggie 2.1.3 beta by injecting malicious JavaScript into the 'errormsg' parameter. The PoC automatically submits a form to trigger the XSS payload.
This exploit demonstrates a cross-site scripting (XSS) vulnerability in MyBloggie 2.1.3 beta by injecting a malicious script via the 'errormsg' parameter in the admin.php page. The PoC includes an auto-submitting form to trigger the XSS payload.
This exploit demonstrates a cross-site scripting (XSS) vulnerability in MyBloggie 2.1.3 beta by injecting arbitrary JavaScript code via the 'id' parameter in the admin.php script. The vulnerability arises due to insufficient input sanitization.
This exploit demonstrates multiple XSS vulnerabilities in MyBloggie 2.1.3 beta by injecting arbitrary script code via unsanitized input in the 'confirmredirect' and 'post_id' parameters.
This exploit demonstrates a cross-site scripting (XSS) vulnerability in MyBloggie 2.1.3 beta by injecting arbitrary JavaScript code via the 'cat_id' parameter in the admin.php script. The vulnerability arises due to insufficient input sanitization.
This exploit demonstrates a cross-site scripting (XSS) vulnerability in MyBloggie 2.1.3 beta by injecting arbitrary JavaScript code via the 'post_id' parameter in the admin.php script. The vulnerability arises due to insufficient input sanitization.
This exploit demonstrates a stored XSS vulnerability in MyBloggie 2.1.3 beta by injecting a malicious script into the 'errormsg' parameter of the admin.php page. The PoC automatically submits a form with the payload, triggering the XSS when the page is rendered.
This exploit demonstrates a cross-site scripting (XSS) vulnerability in MyBloggie by injecting arbitrary JavaScript code via the 'errormsg' parameter in the admin.php page. The PoC automatically submits a form with malicious input to trigger the XSS.