CVE-2006-5626

phpfaber Content Management System < 1.3.36 - Cross-Site Scripting in htmlarea.php

Title source: llm

Exploitation Summary

EIP tracks 1 public exploit for CVE-2006-5626. PoCs published by Vigilon.

AI-analyzed exploit summary The exploit demonstrates a reflected XSS vulnerability in phpFaber CMS 1.3.36 by injecting arbitrary JavaScript via the 'vigilon' parameter in the URL. The PoC uses a simple alert to confirm execution in the context of the affected site.

Description

Cross-site scripting (XSS) vulnerability in cms_images/js/htmlarea/htmlarea.php in phpFaber Content Management System (CMS) before 1.3.36 on 20061026 allows remote attackers to inject arbitrary web script or HTML, probably via arbitrary parameters in the query string, as demonstrated with a vigilon parameter. NOTE: earlier downloads of 1.3.36 have the vulnerability; the software was updated without changing the version number.

Exploits (1)

exploitdb WORKING POC VERIFIED

by Vigilon · textwebappsphp

https://www.exploit-db.com/exploits/28882

View Code ZIP pw:eip

The exploit demonstrates a reflected XSS vulnerability in phpFaber CMS 1.3.36 by injecting arbitrary JavaScript via the 'vigilon' parameter in the URL. The PoC uses a simple alert to confirm execution in the context of the affected site.

Classification

Working Poc 90%

Attack Type

Xss

Complexity

Trivial

Reliability

Reliable

Target: phpFaber CMS 1.3.36

No auth needed

Prerequisites: Access to a vulnerable phpFaber CMS instance · User interaction to click the crafted URL

MITRE ATT&CK