CVE-2006-5770

ac4p_mobile - Cross-Site Scripting via Multiple Parameters

Title source: llm
STIX 2.1

Exploitation Summary

EIP tracks 6 public exploits for CVE-2006-5770. PoCs published by AL-garnei.

AI-analyzed exploit summary The provided text describes a cross-site scripting (XSS) vulnerability in an unspecified 'Mobile' application, where user-supplied input is not properly sanitized. The example URL demonstrates a potential attack vector via the 'footer' parameter.

Description

Multiple cross-site scripting (XSS) vulnerabilities in ac4p Mobile allow remote attackers to inject arbitrary web script or HTML via (1) Bloks, (2) Newnews, (3) lBlok, and (4) foooot parameter in (a) index.php; Newnews, (5) newmsgs, and Bloks parameter in (b) MobileNews.php; Newnews parameter in (c) polls.php; (6) cats parameter in (d) send.php; (7) footer parameter in (e) up.php; and (8) pagenav parameter in (f) cp/index.php.

Exploits (6)

exploitdb WRITEUP VERIFIED
by AL-garnei · textwebappsphp
https://www.exploit-db.com/exploits/28904

The provided text describes a cross-site scripting (XSS) vulnerability in an unspecified 'Mobile' application, where user-supplied input is not properly sanitized. The example URL demonstrates a potential attack vector via the 'footer' parameter.

Classification
Writeup 90%
Attack Type
Xss
Complexity
Trivial
Reliability
Theoretical
Target: Mobile (version unspecified)
No auth needed
Prerequisites: Access to a vulnerable instance of the 'Mobile' application
MITRE ATT&CK
devstral-2 · analyzed Feb 16, 2026 Full analysis →
exploitdb WRITEUP VERIFIED
by AL-garnei · textwebappsphp
https://www.exploit-db.com/exploits/28903

The provided text describes a cross-site scripting (XSS) vulnerability in an unspecified 'Mobile' application, where user-supplied input is not properly sanitized. The example URL demonstrates how an attacker could inject arbitrary script code via the 'cats' parameter.

Classification
Writeup 90%
Attack Type
Xss
Complexity
Trivial
Reliability
Theoretical
Target: Mobile (version unspecified)
No auth needed
Prerequisites: Access to a vulnerable instance of the 'Mobile' application · Ability to craft a malicious URL with XSS payload
MITRE ATT&CK
devstral-2 · analyzed Feb 16, 2026 Full analysis →
exploitdb WRITEUP VERIFIED
by AL-garnei · textwebappsphp
https://www.exploit-db.com/exploits/28902

The provided text describes a cross-site scripting (XSS) vulnerability in an unspecified 'Mobile' application, where user-supplied input is not properly sanitized. The example URL demonstrates how an attacker could inject arbitrary script code via the 'Newnews' parameter.

Classification
Writeup 90%
Attack Type
Xss
Complexity
Trivial
Reliability
Theoretical
Target: Mobile application (version unspecified)
No auth needed
Prerequisites: Access to a vulnerable instance of the 'Mobile' application · Ability to craft a malicious URL with XSS payload
MITRE ATT&CK
devstral-2 · analyzed Feb 16, 2026 Full analysis →
exploitdb WRITEUP VERIFIED
by AL-garnei · textwebappsphp
https://www.exploit-db.com/exploits/28901

The provided text describes a cross-site scripting (XSS) vulnerability in Mobile software, detailing multiple parameters that fail to sanitize user input. It includes example URLs demonstrating the vulnerability but lacks executable exploit code.

Classification
Writeup 90%
Attack Type
Xss
Complexity
Trivial
Reliability
Theoretical
Target: Mobile (version unspecified)
No auth needed
Prerequisites: Access to the vulnerable web application
MITRE ATT&CK
devstral-2 · analyzed Feb 16, 2026 Full analysis →
exploitdb WRITEUP VERIFIED
by AL-garnei · textwebappsphp
https://www.exploit-db.com/exploits/28900

The provided text describes multiple XSS vulnerabilities in an application named 'Mobile' due to improper input sanitization. It lists several URL parameters that are vulnerable to XSS attacks.

Classification
Writeup 90%
Attack Type
Xss
Complexity
Trivial
Reliability
Theoretical
Target: Mobile (version not specified)
No auth needed
Prerequisites: Access to the vulnerable application · Ability to craft malicious URLs
MITRE ATT&CK
devstral-2 · analyzed Feb 16, 2026 Full analysis →
exploitdb WRITEUP VERIFIED
by AL-garnei · textwebappsphp
https://www.exploit-db.com/exploits/28905

The provided text describes a cross-site scripting (XSS) vulnerability in an unspecified 'Mobile' application, where user-supplied input is not properly sanitized. The example URL demonstrates how an attacker could inject arbitrary script code into the 'pagenav' parameter.

Classification
Writeup 90%
Attack Type
Xss
Complexity
Trivial
Reliability
Theoretical
Target: Mobile application (version unspecified)
No auth needed
Prerequisites: Access to the vulnerable application URL
MITRE ATT&CK
devstral-2 · analyzed Feb 16, 2026 Full analysis →

References (9)

Core 9
Core References
Third Party Advisory, VDB Entry vdb-entry x_refsource_xf
https://exchange.xforce.ibmcloud.com/vulnerabilities/30007
Third Party Advisory, VDB Entry vdb-entry x_refsource_osvdb
http://www.osvdb.org/32049
Third Party Advisory, VDB Entry vdb-entry x_refsource_osvdb
http://www.osvdb.org/32050
Third Party Advisory, VDB Entry vdb-entry x_refsource_osvdb
http://www.osvdb.org/32051
Third Party Advisory, VDB Entry vdb-entry x_refsource_osvdb
http://www.osvdb.org/32048
Third Party Advisory, VDB Entry vdb-entry x_refsource_osvdb
http://www.osvdb.org/32047
Third Party Advisory, VDB Entry mailing-list x_refsource_bugtraq
http://www.securityfocus.com/archive/1/450496/100/0/threaded
Exploit vdb-entry x_refsource_bid
http://www.securityfocus.com/bid/20895
Third Party Advisory, VDB Entry vdb-entry x_refsource_osvdb
http://www.osvdb.org/32046

Scores

EPSS 0.0268
EPSS Percentile 83.9%

Details

Status published
Products (1)
ac4p/ac4p_mobile
Published Nov 06, 2006
Tracked Since Feb 18, 2026