CVE-2006-1822

FarsiNews 2.5.3 Pro - Cross-Site Scripting via selected_search_arch Parameter

Title source: llm

Exploitation Summary

EIP tracks 1 public exploit for CVE-2006-1822. PoCs published by amin emami.

AI-analyzed exploit summary This exploit demonstrates a cross-site scripting (XSS) vulnerability in FarsiNews by injecting arbitrary JavaScript code via the 'selected_search_arch' parameter in search.php. The PoC uses a simple alert to display the document.cookie, proving the vulnerability.

Description

Cross-site scripting (XSS) vulnerability in search.php in FarsiNews 2.5.3 Pro and earlier allows remote attackers to inject arbitrary web script or HTML via the selected_search_arch parameter.

Exploits (1)

exploitdb WORKING POC VERIFIED

by amin emami · textwebappsphp

https://www.exploit-db.com/exploits/27650

View Code ZIP pw:eip

This exploit demonstrates a cross-site scripting (XSS) vulnerability in FarsiNews by injecting arbitrary JavaScript code via the 'selected_search_arch' parameter in search.php. The PoC uses a simple alert to display the document.cookie, proving the vulnerability.

Classification

Working Poc 90%

Attack Type

Xss

Complexity

Trivial

Reliability

Reliable

Target: FarsiNews (version not specified)

No auth needed

Prerequisites: Access to the target FarsiNews application · User interaction to trigger the XSS payload

MITRE ATT&CK