CVE-2006-2178

Smartwin Technology Cyberoffice Warehouse Builder - XSS

Title source: rule

Description

Multiple cross-site scripting (XSS) vulnerabilities in CyberBuild allow remote attackers to inject arbitrary web script or HTML via the (1) SessionID parameter to login.asp, (2) ProductIndex parameter to browse0.htm, (3) rowcolor parameter to result.asp, or (4) heading parameter to result.asp. NOTE: vectors 1 and 2 might be resultant from SQL injection.

Exploits (3)

exploitdb WRITEUP VERIFIED

by r0t · textwebappsasp

https://www.exploit-db.com/exploits/27816

View Code ZIP pw:eip

exploitdb WRITEUP VERIFIED

by r0t · textwebappsasp

https://www.exploit-db.com/exploits/27815

View Code ZIP pw:eip

exploitdb WRITEUP VERIFIED

by r0t · textwebappsasp

https://www.exploit-db.com/exploits/27817

View Code ZIP pw:eip

References (8)

[Third Party Advisory] http://pridels0.blogspot.com/2006/05/cyberbuild-vuln.html

[Vendor Advisory] http://secunia.com/advisories/19889

[Exploit] http://www.osvdb.org/25197

[Exploit] http://www.osvdb.org/25198

[Exploit] http://www.osvdb.org/25199

[Exploit] http://www.securityfocus.com/bid/17829

[Vendor Advisory] http://www.vupen.com/english/advisories/2006/1630

[Third Party Advisory, VDB Entry] https://exchange.xforce.ibmcloud.com/vulnerabilities/26202

Scores

EPSS 0.0072

EPSS Percentile 72.2%

Classification

CWE

CWE-79

Status draft

Affected Products (1)

smartwin_technology/cyberoffice_warehouse_builder

Timeline

Published May 04, 2006

Tracked Since Feb 18, 2026