CVE-2006-3533
Pivot 1.30 RC2 - Cross-Site Scripting via Multiple Parameters
Title source: llmExploitation Summary
EIP tracks 1 public exploit for CVE-2006-3533. PoCs published by rgod.
AI-analyzed exploit summary This exploit targets CVE-2006-3533 in Pivot <= 1.30 RC2, leveraging register_globals=On to escalate privileges and execute remote commands. It manipulates the $Pivot_Vars array to bypass authentication and upload malicious PHP files.
Description
Multiple cross-site scripting (XSS) vulnerabilities in Pivot 1.30 RC2 and earlier, when register_globals is enabled, allow remote attackers to inject arbitrary web script or HTML via the (1) fg, (2) line1, (3) line2, (4) bg, (5) c1, (6) c2, (7) c3, and (8) c4 parameters in (a) includes/blogroll.php; (9) name and (10) js_name parameters in (b) includes/editor/edit_menu.php; and, even if register_globals is not enabled, the (11) h and (12) w parameters in (c) includes/photo.php.
Exploits (1)
This exploit targets CVE-2006-3533 in Pivot <= 1.30 RC2, leveraging register_globals=On to escalate privileges and execute remote commands. It manipulates the $Pivot_Vars array to bypass authentication and upload malicious PHP files.