CVE-2006-5108
CubeCart 2.0.x - Cross-Site Scripting via Multiple Parameters
Title source: llmExploitation Summary
EIP tracks 6 public exploits for CVE-2006-5108. PoCs published by HACKERS PAL.
AI-analyzed exploit summary The provided text describes multiple input-validation vulnerabilities in CubeCart, including XSS and SQL injection, but does not contain functional exploit code. It references a generic XSS payload example.
Description
Multiple cross-site scripting (XSS) vulnerabilities in Devellion CubeCart 2.0.x allow remote attackers to inject arbitrary web script or HTML via the order_id parameter in (1) admin/print_order.php and (2) view_order.php; the (3) site_url and (4) la_search_home parameters and (5) certain language parameters in admin/nav.php; the (6) image parameter in admin/image.php; the (7) site_name, (8) la_adm_header, (9) charset, and (10) certain other parameters in admin/header.inc.php; the (12) la_pow_by parameter in footer.inc.php; and the (13) site_name parameter and (14) certain other parameters in header.inc.php.
Exploits (6)
The provided text describes multiple input-validation vulnerabilities in CubeCart, including XSS and SQL injection, but does not contain functional exploit code. It references a generic XSS payload example.
The provided text describes a vulnerability in CubeCart (CVE-2006-5108) involving multiple input-validation issues, including XSS. It includes a sample XSS payload but lacks executable exploit code.
The provided text describes a vulnerability in CubeCart, specifically an XSS issue in the admin/print_order.php endpoint. It includes a proof-of-concept URL demonstrating the vulnerability but lacks executable exploit code.
The exploit demonstrates XSS vulnerabilities in CubeCart's admin interface by injecting JavaScript via the 'site_url' and 'la_search_home' parameters. It leverages improper input sanitization to execute arbitrary script code in the context of a victim's browser.
The provided text describes a vulnerability in CubeCart involving XSS and SQL injection due to improper input sanitization. It includes a sample XSS payload but lacks executable exploit code.
This exploit demonstrates multiple XSS vulnerabilities in CubeCart by injecting malicious JavaScript into vulnerable parameters in the admin header file. The PoC shows how an attacker can steal cookie-based authentication credentials.