CVE-2006-3607
Softbiz Banner Exchange Script 1.0 - Cross-Site Scripting via City Parameter and PHPSESSID Cookie
Title source: llmExploitation Summary
EIP tracks 4 public exploits for CVE-2006-3607. PoCs published by securityconnection.
AI-analyzed exploit summary This exploit demonstrates a cross-site scripting (XSS) vulnerability in Softbiz Banner Exchange by injecting a malicious script via the PHPSESSID cookie in a GET request to lostpassword.php. The script executes in the context of the affected site, potentially stealing credentials or performing other malicious actions.
Description
Multiple cross-site scripting (XSS) vulnerabilities in Softbiz Banner Exchange Script (aka Banner Exchange Network Script) 1.0 allow remote attackers to inject arbitrary web script or HTML via (1) the city parameter in (a) insertmember.php, and (2) a PHPSESSID cookie in (b) lostpassword.php, (c) gen_confirm_mem.php, and (d) index.php.
Exploits (4)
This exploit demonstrates a cross-site scripting (XSS) vulnerability in Softbiz Banner Exchange by injecting a malicious script via the PHPSESSID cookie in a GET request to lostpassword.php. The script executes in the context of the affected site, potentially stealing credentials or performing other malicious actions.
This exploit demonstrates a cross-site scripting (XSS) vulnerability in Softbiz Banner Exchange by injecting a malicious script into the 'city' parameter of a POST request to 'insertmember.php'. The script executes in the context of the affected site, potentially allowing an attacker to steal cookies or perform other malicious actions.
This exploit demonstrates a cross-site scripting (XSS) vulnerability in Softbiz Banner Exchange by injecting a malicious script via the PHPSESSID cookie. The script executes in the context of the affected site, potentially stealing authentication credentials.
This exploit demonstrates a cross-site scripting (XSS) vulnerability in Softbiz Banner Exchange by injecting a malicious script via the PHPSESSID cookie. The PoC shows how arbitrary JavaScript can be executed in the context of the affected site.