CVE-2006-2648

ASPBB 0.52 - Cross-Site Scripting via Search Parameter

Title source: llm

Exploitation Summary

EIP tracks 1 public exploit for CVE-2006-2648. PoCs published by Mustafa Can Bjorn.

AI-analyzed exploit summary This exploit demonstrates a cross-site scripting (XSS) vulnerability in ASPBB 0.5.2 by injecting a script tag into the 'search' parameter of the 'perform_search.asp' endpoint. The script executes an alert with a string constructed from character codes, proving arbitrary JavaScript execution.

Description

Cross-site scripting (XSS) vulnerability in perform_search.asp for ASPBB 0.52 and earlier allows remote attackers to inject arbitrary HTML or web script via the search parameter.

Exploits (1)

exploitdb WORKING POC VERIFIED

by Mustafa Can Bjorn · textwebappsasp

https://www.exploit-db.com/exploits/27918

View Code ZIP pw:eip

This exploit demonstrates a cross-site scripting (XSS) vulnerability in ASPBB 0.5.2 by injecting a script tag into the 'search' parameter of the 'perform_search.asp' endpoint. The script executes an alert with a string constructed from character codes, proving arbitrary JavaScript execution.

Classification

Working Poc 90%

Attack Type

Xss

Complexity

Trivial

Reliability

Reliable

Target: ASPBB 0.5.2

No auth needed

Prerequisites: Access to the vulnerable ASPBB application

MITRE ATT&CK