Exploitation Summary
EIP tracks 5 public exploits for CVE-2006-5830. PoCs published by laurent gaffie.
AI-analyzed exploit summary This exploit demonstrates a reflected XSS vulnerability in All In One Control Panel (AIOCP) by injecting a malicious script via the 'order_field' parameter in 'cp_users_online.php'. The script steals cookie-based authentication credentials when executed in the context of the application.
Description
Multiple cross-site scripting (XSS) vulnerabilities in All In One Control Panel (AIOCP) 1.3.007 and earlier allow remote attackers to inject arbitrary web script or HTML via the (1) topid, (2) forid, and (3) catid parameters to code/cp_forum_view.php; (4) choosed_language parameter to cp_dpage.php; (5) orderdir parameter to cp_links_search.php; (6) order_field parameter to (a) cp_show_ec_products.php and (b) cp_users_online.php; and the (7) signature and (8) fiscal code fields in the user profile.
Exploits (5)
This exploit demonstrates a reflected XSS vulnerability in All In One Control Panel (AIOCP) by injecting a malicious script via the 'order_field' parameter in 'cp_users_online.php'. The script steals cookie-based authentication credentials when executed in the context of the application.
This exploit demonstrates a reflected XSS vulnerability in All In One Control Panel (AIOCP) by injecting a malicious script via the 'order_field' parameter. The script executes in the context of the application, potentially stealing cookie-based authentication credentials.
This exploit demonstrates a reflected XSS vulnerability in All In One Control Panel (AIOCP) by injecting a malicious script via the 'orderdir' parameter. The script executes in the context of the application, potentially stealing cookie-based authentication credentials.
This exploit demonstrates multiple reflected XSS vulnerabilities in All In One Control Panel (AIOCP) by injecting malicious JavaScript via unsanitized input parameters. The PoC uses crafted URLs to execute arbitrary script code in the context of the application, potentially stealing cookie-based authentication credentials.
This exploit demonstrates a reflected XSS vulnerability in All In One Control Panel (AIOCP) by injecting a malicious script via the 'choosed_language' parameter. The script executes in the context of the application, potentially stealing cookie-based authentication credentials.