CVE-2006-5146
Yblog - Stored Cross-Site Scripting via id Parameter in funk.php
Title source: llmExploitation Summary
EIP tracks 3 public exploits for CVE-2006-5146. PoCs published by You_You.
AI-analyzed exploit summary The provided text describes a cross-site scripting (XSS) vulnerability in Yblog, where user-supplied input is not properly sanitized. The example demonstrates an XSS payload injected via the 'action' parameter in the 'uss.php' script.
Description
Multiple cross-site scripting (XSS) vulnerabilities in Yblog allow remote attackers to inject arbitrary web script or HTML via the (1) id parameter in (a) funk.php, or the (2) action parameter in (b) tem.php and (c) uss.php.
Exploits (3)
The provided text describes a cross-site scripting (XSS) vulnerability in Yblog, where user-supplied input is not properly sanitized. The example demonstrates an XSS payload injected via the 'action' parameter in the 'uss.php' script.
This exploit demonstrates a cross-site scripting (XSS) vulnerability in Yblog by injecting arbitrary JavaScript code via the 'action' parameter in the 'tem.php' file. The PoC uses a simple alert box to confirm the vulnerability.
This exploit demonstrates a cross-site scripting (XSS) vulnerability in Yblog by injecting arbitrary JavaScript code via the 'id' parameter in funk.php. The PoC uses a simple alert box to confirm the vulnerability.