CVE-2006-3358
NewsPHP 2006 PRO - Cross-Site Scripting via Index.php Parameters
Title source: llmExploitation Summary
EIP tracks 2 public exploits for CVE-2006-3358. PoCs published by securityconnection.
AI-analyzed exploit summary The provided text describes SQL injection and XSS vulnerabilities in NewsPHP 2006 PRO due to insufficient input sanitization. It includes example URLs demonstrating potential attack vectors but lacks executable exploit code.
Description
Multiple cross-site scripting (XSS) vulnerabilities in index.php in NewsPHP 2006 PRO allow remote attackers to inject arbitrary web script or HTML via the (1) words, (2) id, (3) cat_id, and (4) tim parameters, which are not sanitized before being returned in an error page. NOTE: it is possible that some of these vectors are resultant from an SQL injection issue.
Exploits (2)
The provided text describes SQL injection and XSS vulnerabilities in NewsPHP 2006 PRO due to insufficient input sanitization. It includes example URLs demonstrating potential attack vectors but lacks executable exploit code.
The exploit demonstrates multiple XSS vulnerabilities in NewsPHP 2006 PRO by injecting malicious scripts via URL parameters. The PoC includes various payloads targeting different input fields, confirming the lack of input sanitization.