CVE-2006-6211
BirdBlog 1.4.0 - Stored Cross-Site Scripting via msg, month, or page Parameters
Title source: llmExploitation Summary
EIP tracks 4 public exploits for CVE-2006-6211. PoCs published by the_Edit0r.
AI-analyzed exploit summary This exploit demonstrates a cross-site scripting (XSS) vulnerability in BirdBlog 1.4.0 by injecting a script tag into the 'page' parameter of the logs.php file. The PoC triggers an alert box, proving arbitrary script execution in the context of the affected site.
Description
Multiple cross-site scripting (XSS) vulnerabilities in BirdBlog 1.4.0 allow remote attackers to inject arbitrary web script or HTML via the (1) msg parameter to (a) admin/admincore.php, the (2) month parameter to (b) admin/comments.php or (c) admin/entries.php, or the (3) page parameter to (d) admin/logs.php, different vectors than CVE-2006-5064.
Exploits (4)
This exploit demonstrates a cross-site scripting (XSS) vulnerability in BirdBlog 1.4.0 by injecting a script tag into the 'page' parameter of the logs.php file. The PoC triggers an alert box, proving arbitrary script execution in the context of the affected site.
This exploit demonstrates a cross-site scripting (XSS) vulnerability in BirdBlog 1.4.0 by injecting a script tag into the 'month' parameter of the admin/entries.php page. The PoC triggers an alert box, proving arbitrary script execution in the context of the affected site.
This exploit demonstrates a cross-site scripting (XSS) vulnerability in BirdBlog 1.4.0 by injecting arbitrary JavaScript code via the 'month' parameter in the admin/comments.php page. The PoC uses a simple alert script to confirm the vulnerability.
This exploit demonstrates a cross-site scripting (XSS) vulnerability in BirdBlog 1.4.0 by injecting a script tag into the 'msg' parameter of admincore.php. The PoC triggers an alert box, proving arbitrary JavaScript execution in the context of the affected site.