CVE-2006-2746
facile_interactive_web < 0.8.5 - Cross-Site Scripting via lang, mytheme, and myskin Parameters
Title source: llmExploitation Summary
EIP tracks 1 public exploit for CVE-2006-2746. PoCs published by nukedx.
AI-analyzed exploit summary The exploit demonstrates multiple remote vulnerabilities in F@cile Interactive Web <= 0.8x, including file inclusion, XSS, and information disclosure. It provides direct URLs to exploit these vulnerabilities, such as arbitrary file inclusion via null byte injection and path traversal.
Description
Multiple cross-site scripting (XSS) vulnerabilities in F@cile Interactive Web 0.8.5 and earlier allow remote attackers to inject arbitrary web script or HTML via the (1) lang parameter in index.php, and the (2) mytheme and (3) myskin parameters in multiple "p-themes" index.inc.php files including (c) lowgraphic, (d) classic, (e) puzzle, (f) simple, and (g) ciao. NOTE: vectors 2 and 3 might be resultant from file inclusion issues.
Exploits (1)
The exploit demonstrates multiple remote vulnerabilities in F@cile Interactive Web <= 0.8x, including file inclusion, XSS, and information disclosure. It provides direct URLs to exploit these vulnerabilities, such as arbitrary file inclusion via null byte injection and path traversal.