Lucene search

K
exploitdbThe_Edit0rEDB-ID:29056
HistoryNov 16, 2006 - 12:00 a.m.

Eggblog 3.1 admin/comments.php edit Parameter XSS

2006-11-1600:00:00
the_Edit0r
www.exploit-db.com
11

6.8 Medium

CVSS2

Access Vector

NETWORK

Access Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:M/Au:N/C:P/I:P/A:P

0.002 Low

EPSS

Percentile

57.6%

Eggblog 3.1 admin/comments.php edit Parameter XSS. CVE-2006-6046. Webapps exploit for php platform

source: http://www.securityfocus.com/bid/21134/info
 
Eggblog is prone to multiple cross-site scripting vulnerabilities because it fails to properly sanitize user-supplied input. 
 
An attacker may leverage these issues to have arbitrary script code execute in the browser of an unsuspecting user in the context of the affected site. This may help the attacker to steal cookie-based authentication credentials and to launch other attacks.
 
http://www.example.com/[path]/admin/comments.php?edit="><script>alert('Xmors')</script><

6.8 Medium

CVSS2

Access Vector

NETWORK

Access Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:M/Au:N/C:P/I:P/A:P

0.002 Low

EPSS

Percentile

57.6%

Related for EDB-ID:29056