CVE-2006-1802

TinyWebGallery 1.3 and 1.4 - Cross-Site Scripting via twg_album Parameter

Title source: llm

Exploitation Summary

EIP tracks 1 public exploit for CVE-2006-1802. PoCs published by Qex.

AI-analyzed exploit summary This exploit demonstrates a cross-site scripting (XSS) vulnerability in Tiny Web Gallery versions 1.4 and prior. The vulnerability arises from improper sanitization of user-supplied input in the 'twg_album' parameter, allowing arbitrary script execution in the context of the affected site.

Description

Cross-site scripting (XSS) vulnerability in index.php in TinyWebGallery 1.3 and 1.4 allows remote attackers to inject arbitrary web script or HTML via the twg_album parameter.

Exploits (1)

exploitdb WORKING POC VERIFIED

by Qex · textwebappsphp

https://www.exploit-db.com/exploits/27651

View Code ZIP pw:eip

This exploit demonstrates a cross-site scripting (XSS) vulnerability in Tiny Web Gallery versions 1.4 and prior. The vulnerability arises from improper sanitization of user-supplied input in the 'twg_album' parameter, allowing arbitrary script execution in the context of the affected site.

Classification

Working Poc 90%

Attack Type

Xss

Complexity

Trivial

Reliability

Reliable

Target: Tiny Web Gallery <= 1.4

No auth needed

Prerequisites: Access to the vulnerable web application

MITRE ATT&CK