CVE-2006-2174

Virtual Hosting Control System - Cross-Site Scripting via day/month/year Parameters

Title source: llm

Exploitation Summary

EIP tracks 1 public exploit for CVE-2006-2174. PoCs published by O.U.T.L.A.W.

AI-analyzed exploit summary The provided text describes multiple XSS vulnerabilities in Virtual Hosting Control System due to improper input sanitization in the 'server_day_stats.php' script. It includes example URLs demonstrating the vulnerability but lacks executable exploit code.

Description

Multiple cross-site scripting (XSS) vulnerabilities in admin/server_day_stats.php in Virtual Hosting Control System (VHCS) allow remote attackers to inject arbitrary web script or HTML via the (1) day, (2) month, or (3) year parameter.

Exploits (1)

exploitdb WRITEUP VERIFIED

by O.U.T.L.A.W · textwebappsphp

https://www.exploit-db.com/exploits/27799

View Code ZIP pw:eip

The provided text describes multiple XSS vulnerabilities in Virtual Hosting Control System due to improper input sanitization in the 'server_day_stats.php' script. It includes example URLs demonstrating the vulnerability but lacks executable exploit code.

Classification

Writeup 90%

Attack Type

Xss

Complexity

Trivial

Reliability

Theoretical

Target: Virtual Hosting Control System

No auth needed

Prerequisites: Access to the vulnerable URL endpoints

MITRE ATT&CK