CVE-2006-2048

phpWebFTP 2.3 - Cross-Site Scripting via Port, Server, or User Parameters

Title source: llm

Exploitation Summary

EIP tracks 1 public exploit for CVE-2006-2048. PoCs published by arko.dhar.

AI-analyzed exploit summary This exploit demonstrates multiple XSS vulnerabilities in phpWebFTP due to improper sanitization of user-supplied input via HTTP POST. The PoC includes various payloads injected into parameters like 'server', 'port', and 'user' to trigger arbitrary script execution in a user's browser context.

Description

Multiple cross-site scripting (XSS) vulnerabilities in index.php in Edwin van Wijk phpWebFTP 2.3 allow remote attackers to inject arbitrary web script or HTML via the (1) port, (2) server, and (3) user parameters. NOTE: it is possible that the affected version is actually 3.2.

Exploits (1)

exploitdb WORKING POC VERIFIED

by arko.dhar · textwebappsphp

https://www.exploit-db.com/exploits/27735

View Code ZIP pw:eip

This exploit demonstrates multiple XSS vulnerabilities in phpWebFTP due to improper sanitization of user-supplied input via HTTP POST. The PoC includes various payloads injected into parameters like 'server', 'port', and 'user' to trigger arbitrary script execution in a user's browser context.

Classification

Working Poc 90%

Attack Type

Xss

Complexity

Trivial

Reliability

Reliable

Target: phpWebFTP (version not specified)

No auth needed

Prerequisites: Access to a vulnerable phpWebFTP instance · Ability to craft malicious URLs or POST requests

MITRE ATT&CK