CVE-2006-4742

IDevSpot PhpLinkExchange 1.0 - Cross-Site Scripting via User Add Msg Parameter

Title source: llm
STIX 2.1

Exploitation Summary

EIP tracks 1 public exploit for CVE-2006-4742. PoCs published by s3rv3r_hack3r.

AI-analyzed exploit summary This exploit demonstrates a remote file inclusion vulnerability in PhpLinkExchange by idevspot.com, allowing an attacker to include arbitrary files via the 'svr_rootPhpStart' parameter. Additionally, it highlights an XSS vulnerability in the 'msg' parameter of user_add.php.

Description

Cross-site scripting (XSS) vulnerability in user_add.php in IDevSpot PhpLinkExchange 1.0 allows remote attackers to inject arbitrary web script or HTML via the msg parameter.

Exploits (1)

exploitdb WORKING POC VERIFIED
by s3rv3r_hack3r · textwebappsphp
https://www.exploit-db.com/exploits/2347

This exploit demonstrates a remote file inclusion vulnerability in PhpLinkExchange by idevspot.com, allowing an attacker to include arbitrary files via the 'svr_rootPhpStart' parameter. Additionally, it highlights an XSS vulnerability in the 'msg' parameter of user_add.php.

Classification
Working Poc 90%
Attack Type
Rce
Complexity
Trivial
Reliability
Reliable
Target: PhpLinkExchange by idevspot.com
No auth needed
Prerequisites: Network access to the target application
devstral-2 · analyzed Feb 16, 2026 Full analysis →

References (3)

Core 3
Core References
Third Party Advisory third-party-advisory x_refsource_sreason
http://securityreason.com/securityalert/1561
Third Party Advisory, VDB Entry mailing-list x_refsource_bugtraq
http://www.securityfocus.com/archive/1/445780/100/0/threaded
Exploit vdb-entry x_refsource_bid
http://www.securityfocus.com/bid/19931

Scores

EPSS 0.0163
EPSS Percentile 73.1%

Details

Status published
Products (1)
idevspot/phplinkexchange 1.0
Published Sep 13, 2006
Tracked Since Feb 18, 2026