CVE-2006-2490
Mobotix IP Network Camera <2.2.3.18 (M10/D10) & <3.0.3.31 (M22) XSS via URL-Encoded Parameters
Title source: llmExploitation Summary
EIP tracks 3 public exploits for CVE-2006-2490. PoCs published by Jaime Blasco.
AI-analyzed exploit summary The provided text describes a cross-site scripting (XSS) vulnerability in Mobotix IP cameras due to insufficient input sanitization. It includes a proof-of-concept URL demonstrating the issue but lacks executable exploit code.
Description
Multiple cross-site scripting (XSS) vulnerabilities in Mobotix IP Network Cameras M1 1.9.4.7 and M10 2.0.5.2, and other versions before 2.2.3.18 for M10/D10 and 3.0.3.31 for M22, allow remote attackers to inject arbitrary web script or HTML via URL-encoded values in (1) the query string to help/help, (2) the get_image_info_abspath parameter to control/eventplayer, and (3) the source_ip parameter to events.tar.
Exploits (3)
The provided text describes a cross-site scripting (XSS) vulnerability in Mobotix IP cameras due to insufficient input sanitization. It includes a proof-of-concept URL demonstrating the issue but lacks executable exploit code.
This exploit demonstrates a cross-site scripting (XSS) vulnerability in Mobotix IP cameras by injecting arbitrary JavaScript code via the 'source_ip' parameter in the 'events.tar' endpoint. The payload triggers an alert dialog, proving the lack of input sanitization.
This exploit demonstrates a cross-site scripting (XSS) vulnerability in Mobotix IP cameras by injecting arbitrary script code via the 'get_image_info_abspath' parameter. The PoC uses a simple alert-based payload to confirm the vulnerability.