CVE-2006-2143

TextFileBB 1.0.16 - Cross-Site Scripting via BBCode Tag Event Handlers

Title source: llm

Exploitation Summary

EIP tracks 1 public exploit for CVE-2006-2143. PoCs published by r0xes.

AI-analyzed exploit summary The exploit demonstrates multiple XSS vulnerabilities in TextFileBB 1.0.16 by injecting malicious scripts via unsanitized input in BBCode tags. The PoC includes examples of script injection through 'color', 'size', and 'url' tags, triggering alerts when hovered.

Description

Multiple cross-site scripting (XSS) vulnerabilities in TextFileBB 1.0.16 allow remote attackers to inject arbitrary web script or HTML via Javascript events such as "onmouseover" in the (1) color, (2) size, or (3) url bbcode tags.

Exploits (1)

exploitdb WORKING POC VERIFIED

by r0xes · textwebappsphp

https://www.exploit-db.com/exploits/27782

View Code ZIP pw:eip

The exploit demonstrates multiple XSS vulnerabilities in TextFileBB 1.0.16 by injecting malicious scripts via unsanitized input in BBCode tags. The PoC includes examples of script injection through 'color', 'size', and 'url' tags, triggering alerts when hovered.

Classification

Working Poc 90%

Attack Type

Xss

Complexity

Trivial

Reliability

Reliable

Target: TextFileBB 1.0.16

No auth needed

Prerequisites: Access to a vulnerable TextFileBB instance · Ability to post or inject malicious BBCode

MITRE ATT&CK