CVE-2006-1326
Invision Power Board 2.0.4 - Cross-Site Scripting via Multiple Search Parameters
Title source: llmExploitation Summary
EIP tracks 7 public exploits for CVE-2006-1326. PoCs published by Mr.SNAKE.
AI-analyzed exploit summary This exploit demonstrates multiple XSS vulnerabilities in Invision Power Board due to insufficient input sanitization in the 'sort_key', 'sort_order', and 'max_results' parameters. The PoC uses script injection to execute arbitrary JavaScript in the context of the affected site.
Description
Multiple cross-site scripting (XSS) vulnerabilities in Invision Power Board 2.0.4 allow remote attackers to inject arbitrary web script or HTML via the (1) result_type, (2) search_in, (3) nav, (4) forums, and (5) s parameters in the Search action to index.php; (6) st parameter to index.php with showtopics set to 1; (7) m, (8) y, and (9) d parameters in a calendar action; (10) t parameter in a Print action; (11) MID parameter in a Mail action; (12) HID parameter in a Help action; (13) active parameter in a search action; (14) sort_order, (15) max_results, or (16) sort_key parameter in a Members action.
Exploits (7)
This exploit demonstrates multiple XSS vulnerabilities in Invision Power Board due to insufficient input sanitization in the 'sort_key', 'sort_order', and 'max_results' parameters. The PoC uses script injection to execute arbitrary JavaScript in the context of the affected site.
This exploit demonstrates multiple XSS vulnerabilities in Invision Power Board by injecting arbitrary script code via unsanitized input parameters in the search functionality. The PoC URLs trigger JavaScript execution in the context of the affected site.
This exploit demonstrates a cross-site scripting (XSS) vulnerability in Invision Power Board by injecting a script tag into the URL parameters, which executes arbitrary JavaScript in the context of the affected site.
This exploit demonstrates a reflected XSS vulnerability in Invision Power Board due to improper input sanitization. The PoC URL injects a script tag to execute arbitrary JavaScript in the context of the affected site.
This exploit demonstrates a cross-site scripting (XSS) vulnerability in Invision Power Board by injecting a script tag into the 'HID' parameter of the Help page. The PoC uses a simple alert to display the user's cookies, proving arbitrary script execution.
This exploit demonstrates multiple XSS vulnerabilities in Invision Power Board by injecting arbitrary JavaScript code via unsanitized input parameters in the calendar functionality.
This exploit demonstrates a cross-site scripting (XSS) vulnerability in Invision Power Board due to insufficient input sanitization. The PoC URL injects arbitrary JavaScript code to execute in the context of the affected site.