CVE-2006-6824
php_icalendar < 2.23_rc1 - Cross-Site Scripting via Multiple Parameters
Title source: llmExploitation Summary
EIP tracks 8 public exploits for CVE-2006-6824. PoCs published by Lostmon.
AI-analyzed exploit summary This exploit demonstrates a cross-site scripting (XSS) vulnerability in PHP iCalendar due to improper input sanitization. The PoC shows how arbitrary script code can be executed in the browser of an unsuspecting user via a crafted URL.
Description
Multiple cross-site scripting (XSS) vulnerabilities in Jim Hu and Chad Little PHP iCalendar 2.23 rc1 and earlier allow remote attackers to inject arbitrary web script or HTML via the (1) getdate parameter in (a) day.php, (b) month.php, (c) year.php, (d) week.php, (e) search.php, (f) rss/index.php, (g) print.php, and (h) preferences.php; the (2) cpath parameter in (i) day.php, (j) month.php, (k) year.php, (l) week.php, and (m) search.php; the (3) query parameter in search.php; and possibly the cpath, (4) unset, and (5) set parameters in a setcookie action in preferences.php; different vectors than CVE-2006-3319. NOTE: it was later reported that vectors b, c, and d also affect 2.24.
Exploits (8)
This exploit demonstrates a cross-site scripting (XSS) vulnerability in PHP iCalendar due to improper input sanitization. The PoC shows how arbitrary script code can be executed in the browser of an unsuspecting user via a crafted URL.
This exploit demonstrates a cross-site scripting (XSS) vulnerability in PHP iCalendar by injecting arbitrary script code via the 'cal' and 'getdate' parameters in the URL. The lack of input sanitization allows execution of malicious scripts in the context of a user's browser session.
The exploit demonstrates multiple XSS vulnerabilities in PHP iCalendar by injecting arbitrary script code via unsanitized user input in the 'cpath', 'cal', and 'getdate' parameters.
This exploit demonstrates a cross-site scripting (XSS) vulnerability in PHP iCalendar due to improper input sanitization. The PoC URL injects arbitrary JavaScript code via the 'getdate' parameter, which executes in the context of the user's browser.
This exploit demonstrates multiple XSS vulnerabilities in PHP iCalendar's preferences.php by injecting malicious JavaScript into user-supplied input fields. The PoC includes both URL-based and form-based injection vectors.
This exploit demonstrates a cross-site scripting (XSS) vulnerability in PHP iCalendar due to improper input sanitization. The PoC shows how arbitrary script code can be executed in a user's browser via a crafted URL.
This exploit demonstrates a cross-site scripting (XSS) vulnerability in PHP iCalendar due to improper input sanitization. The PoC shows how arbitrary script code can be executed in a user's browser via a crafted URL.
This exploit demonstrates a cross-site scripting (XSS) vulnerability in PHP iCalendar due to improper input sanitization. The PoC shows how arbitrary script code can be executed in a user's browser via a crafted URL.