Vulnerabilities > CVE-2006-4881 - Unspecified vulnerability in David Bennett PHP-Post

047910
CVSS 0.0 - NONE
Attack vector
UNKNOWN
Attack complexity
UNKNOWN
Privileges required
UNKNOWN
Confidentiality impact
UNKNOWN
Integrity impact
UNKNOWN
Availability impact
UNKNOWN
david-bennett
exploit available
NVD
Published: 2006-09-19
Updated: 2024-11-21

Summary

Multiple cross-site scripting (XSS) vulnerabilities in David Bennett PHP-Post (PHPp) 1.0 and earlier allow remote attackers to inject arbitrary web script or HTML via (1) the replyuser parameter in (a) pm.php; (2) the txt_jumpto parameter in (b) dropdown.php; the (3) txt_error and (4) txt_templatenotexist parameters in (c) template.php; the (5) split parameter in certain files, as demonstrated by (d) editprofile.php, (e) search.php, (f) index.php, and (g) pm.php; and the (6) txt_login parameter in (h) loginline.php; and allow remote authenticated users to inject arbitrary web script or HTML via the (7) txt_logout parameter in (i) loginline.php.

Vulnerable Configurations

Part Description Count
Application
David_Bennett
1

Exploit-Db

descriptionPHP-post Web Forum 0.x.1.0 pm.php replyuser Parameter XSS. CVE-2006-4881. Webapps exploit for php platform
idEDB-ID:28592
last seen2016-02-03
modified2006-09-16
published2006-09-16
reporterHACKERS PAL
sourcehttps://www.exploit-db.com/download/28592/
titlePHP-post Web Forum 0.x.1.0 pm.php replyuser Parameter XSS

References