CVE-2006-4668

Rob Hensley AckerTodo 4.0 - Cross-Site Scripting via task_id Parameter

Title source: llm

Exploitation Summary

EIP tracks 1 public exploit for CVE-2006-4668. PoCs published by viz.security.

AI-analyzed exploit summary This exploit demonstrates a cross-site scripting (XSS) vulnerability in AckerTodo 4.0 by injecting a script tag into the 'task_id' parameter of the 'edit_task' command. The script extracts and displays the user's cookies, proving the vulnerability.

Description

Cross-site scripting (XSS) vulnerability in index.php in Rob Hensley AckerTodo 4.0 allows remote attackers to inject arbitrary web script or HTML via the task_id parameter in an edit_task command.

Exploits (1)

exploitdb WORKING POC VERIFIED

by viz.security · textwebappsphp

https://www.exploit-db.com/exploits/28494

View Code ZIP pw:eip

This exploit demonstrates a cross-site scripting (XSS) vulnerability in AckerTodo 4.0 by injecting a script tag into the 'task_id' parameter of the 'edit_task' command. The script extracts and displays the user's cookies, proving the vulnerability.

Classification

Working Poc 90%

Attack Type

Xss

Complexity

Trivial

Reliability

Reliable

Target: AckerTodo 4.0

No auth needed

Prerequisites: Access to the vulnerable AckerTodo application

MITRE ATT&CK