CVE-2006-3259
e107 < 0.7.5 - Cross-Site Scripting via Search and Comment Parameters
Title source: llmExploitation Summary
EIP tracks 2 public exploits for CVE-2006-3259. PoCs published by EllipSiS Security, securityconnection.
AI-analyzed exploit summary This exploit demonstrates an HTML injection vulnerability in e107 CMS, allowing arbitrary script execution in the context of the affected site. The PoC provides a simple payload to trigger an XSS alert when inserted into the 'Subject' field of a comment submission.
Description
Multiple cross-site scripting (XSS) vulnerabilities in e107 0.7.5 allow remote attackers to inject arbitrary web script or HTML via the (1) ep parameter to search.php and the (2) subject parameter in comment.php (aka the Subject field when posting a comment).
Exploits (2)
This exploit demonstrates an HTML injection vulnerability in e107 CMS, allowing arbitrary script execution in the context of the affected site. The PoC provides a simple payload to trigger an XSS alert when inserted into the 'Subject' field of a comment submission.
This exploit demonstrates a cross-site scripting (XSS) vulnerability in e107 by injecting a script tag into the search query parameter. The PoC uses a crafted URL to trigger an alert box, proving arbitrary script execution in the context of the affected site.