CVE-2006-6517
kdpics < 1.16 - Cross-Site Scripting via Categories Parameter
Title source: llmExploitation Summary
EIP tracks 3 public exploits for CVE-2006-6517. PoCs published by AsTrex, Mr_KaLiMaN.
AI-analyzed exploit summary This exploit demonstrates a Remote File Include (RFI) vulnerability in KDPics <= 2006, specifically in the 'lib/exifer/exif.php' file. The attacker can include and execute arbitrary remote code by manipulating the 'lib_path' parameter.
Description
Multiple cross-site scripting (XSS) vulnerabilities in KDPics 1.16 and earlier allow remote attackers to inject arbitrary web script or HTML via the (1) categories parameter to (a) index.php3 or (b) galeries.inc.php3.
Exploits (3)
This exploit demonstrates a Remote File Include (RFI) vulnerability in KDPics <= 2006, specifically in the 'lib/exifer/exif.php' file. The attacker can include and execute arbitrary remote code by manipulating the 'lib_path' parameter.
The provided text describes a vulnerability in KDPics 1.16 and prior versions, highlighting XSS and remote file inclusion issues due to insufficient input sanitization. It includes a sample URL demonstrating the XSS vulnerability but lacks executable exploit code.
The provided text describes a vulnerability in KDPics 1.16 and prior versions, highlighting cross-site scripting (XSS) and remote file inclusion (RFI) issues due to insufficient input sanitization. It includes a sample URL demonstrating the XSS vulnerability but lacks executable exploit code.