CVE-2006-6447
vt-forum_lite 1.3 and 1.5 - Cross-Site Scripting via StrMes Parameter
Title source: llmExploitation Summary
EIP tracks 2 public exploits for CVE-2006-6447. PoCs published by St@rExT.
AI-analyzed exploit summary The provided text describes a cross-site scripting (XSS) vulnerability in Vt-Forum Lite 1.3, where user-supplied input is not properly sanitized. The example demonstrates an HTML injection attack via the 'vf_newtopic.asp' script.
Description
Multiple cross-site scripting (XSS) vulnerabilities in Vt-Forum Lite 1.3 and 1.5 allow remote attackers to inject arbitrary web script or HTML via (1) the StrMes parameter in vf_info.asp and possibly (2) a URL in the SRC attribute of an IFRAME element that is submitted to vf_newtopic.asp.
Exploits (2)
The provided text describes a cross-site scripting (XSS) vulnerability in Vt-Forum Lite 1.3, where user-supplied input is not properly sanitized. The example demonstrates an HTML injection attack via the 'vf_newtopic.asp' script.
The provided text describes a cross-site scripting (XSS) vulnerability in Vt-Forum Lite version 1.3, where user-supplied input is not properly sanitized. The vulnerability allows arbitrary script execution in the context of the affected site, potentially leading to cookie theft or other attacks.