23226Third-party advisory
http://secunia.com/advisories/23226 CVE-2006-6447
Vt-Forum Lite 1.3 - 'vf_info.asp?StrMes' Cross-Site Scripting
Record summary
CVE-2006-6447 has a selected CVSS score of 6.8; EIP currently links 2 catalogued exploits.
Description
Multiple cross-site scripting (XSS) vulnerabilities in Vt-Forum Lite 1.3 and 1.5 allow remote attackers to inject arbitrary web script or HTML via (1) the StrMes parameter in vf_info.asp and possibly (2) a URL in the SRC attribute of an IFRAME element that is submitted to vf_newtopic.asp.
Description source: CVE List
Exploitation context
Available material
- Catalogued exploits
- 2
Proofs of concept
2Catalogued exploits
ExploitDBVt-Forum Lite 1.3 - 'vf_info.asp?StrMes' Cross-Site ScriptingExploitDB exploitby St@rExTNot analyzed1 file
ExploitDBVt-Forum Lite 1.3 - 'vf_newtopic.asp' IFRAME Element Cross-Site ScriptingExploitDB exploitby St@rExTNot analyzed1 file
References
72011Third-party advisory
http://securityreason.com/securityalert/2011 20061203 Vt-Forum Lite System V.1.3 Xss Vuln.mailing list
http://www.securityfocus.com/archive/1/453452/100/0/threaded 21428vdb entry
http://www.securityfocus.com/bid/21428 ADV-2006-4850vdb entry
http://www.vupen.com/english/advisories/2006/4850 vtforum-multiple-xss(30725)vdb entry
https://exchange.xforce.ibmcloud.com/vulnerabilities/30725 nvd.nist.gov
https://nvd.nist.gov/vuln/detail/CVE-2006-6447