CVE-2006-4449

MyBulletinBoard 1.1.7 - Cross-Site Scripting via GIF Image with URL-Encoded JavaScript

Title source: llm

Exploitation Summary

EIP tracks 1 public exploit for CVE-2006-4449. PoCs published by Redworm.

AI-analyzed exploit summary This exploit demonstrates an HTML injection vulnerability in MyBB 1.1.7, where user-supplied input is not properly sanitized. The provided URL-encoded JavaScript payload creates an image object that exfiltrates the user's cookie to a remote server.

Description

Cross-site scripting (XSS) vulnerability in attachment.php in MyBulletinBoard (MyBB) 1.1.7 and possibly other versions allows remote attackers to inject arbitrary web script or HTML via a GIF image that contains URL-encoded Javascript, which is rendered by Internet Explorer.

Exploits (1)

exploitdb WORKING POC VERIFIED

by Redworm · javascriptwebappsphp

https://www.exploit-db.com/exploits/28429

View Code ZIP pw:eip

This exploit demonstrates an HTML injection vulnerability in MyBB 1.1.7, where user-supplied input is not properly sanitized. The provided URL-encoded JavaScript payload creates an image object that exfiltrates the user's cookie to a remote server.

Classification

Working Poc 90%

Attack Type

Xss

Complexity

Trivial

Reliability

Reliable

Target: MyBB 1.1.7

No auth needed

Prerequisites: Victim must visit a crafted URL or page with the injected script

MITRE ATT&CK