CVE-2006-2699

Geeklog <= 1.4.0sr2 - Cross-Site Scripting via getimage.php Image Parameter

Title source: llm

Exploitation Summary

EIP tracks 1 public exploit for CVE-2006-2699. PoCs published by trueend5.

AI-analyzed exploit summary The provided text describes a vulnerability in Geeklog 1.4.0sr2 involving XSS and SQL injection due to improper input sanitization. It includes a sample XSS payload but lacks executable exploit code.

Description

Cross-site scripting (XSS) vulnerability in getimage.php in Geeklog 1.4.0sr2 and earlier allows remote attackers to inject arbitrary HTML or web script via the image argument in a show action.

Exploits (1)

exploitdb WRITEUP VERIFIED

by trueend5 · textwebappsphp

https://www.exploit-db.com/exploits/27919

View Code ZIP pw:eip

The provided text describes a vulnerability in Geeklog 1.4.0sr2 involving XSS and SQL injection due to improper input sanitization. It includes a sample XSS payload but lacks executable exploit code.

Classification

Writeup 90%

Attack Type

Xss

Complexity

Trivial

Reliability

Theoretical

Target: Geeklog 1.4.0sr2

No auth needed

Prerequisites: Access to the vulnerable Geeklog instance

MITRE ATT&CK