CVE-2006-3616
Carbonize Lazarus Guestbook <= 1.6 - Cross-Site Scripting via show and img Parameters
Title source: llmExploitation Summary
EIP tracks 2 public exploits for CVE-2006-3616. PoCs published by simo64.
AI-analyzed exploit summary The provided text describes a cross-site scripting (XSS) vulnerability in Lazarus Guestbook version 1.6, where user-supplied input is not properly sanitized. Example URLs demonstrate how arbitrary script code can be executed in the context of the affected site.
Description
Multiple cross-site scripting (XSS) vulnerabilities in Carbonize Lazarus Guestbook 1.6 and earlier allow remote attackers to inject arbitrary web script or HTML via (1) the show parameter in codes-english.php and (2) the img parameter in picture.php, after the name of an existing file.
Exploits (2)
The provided text describes a cross-site scripting (XSS) vulnerability in Lazarus Guestbook version 1.6, where user-supplied input is not properly sanitized. Example URLs demonstrate how arbitrary script code can be executed in the context of the affected site.
The exploit demonstrates XSS vulnerabilities in Lazarus Guestbook by injecting arbitrary script code via the 'show' parameter in the 'codes-english.php' file. The PoC includes example URLs that trigger XSS by closing the title tag and injecting a script.