CVE-2010-3266
BugTracker.NET < 3.4.5 - Authenticated Cross-Site Scripting via Multiple Parameters
Title source: llmExploitation Summary
EIP tracks 2 public exploits for CVE-2010-3266. PoCs published by Core Security, BugTracker.NET.
AI-analyzed exploit summary This advisory details multiple XSS and SQL injection vulnerabilities in BugTracker.Net, including proof-of-concept examples for exploitation. It provides technical descriptions of the flaws in specific files and lines of code.
Description
Multiple cross-site scripting (XSS) vulnerabilities in BugTracker.NET before 3.4.5 allow remote authenticated users to inject arbitrary web script or HTML via (1) the pcd parameter to edit_bug.aspx, (2) the bug_id parameter to edit_comment.aspx, (3) the id parameter to edit_user_permissions2.aspx, or (4) the default_name parameter to edit_customfield.aspx. NOTE: some of these details are obtained from third party information.
Exploits (2)
This advisory details multiple XSS and SQL injection vulnerabilities in BugTracker.Net, including proof-of-concept examples for exploitation. It provides technical descriptions of the flaws in specific files and lines of code.
The provided text describes an SQL injection and XSS vulnerability in BugTracker.NET v3.4.4, with an example XSS payload. It lacks executable exploit code but details the vulnerability and potential impact.