CVE-2006-0442

Public exploit code

Working exploit or proof of concept code has been published for this vulnerability. Treat unpatched systems as at risk.

• MyBB 1.0.1/1.0.2 Notepad - 'usercp.php' HTML Injection2006-01-24 · webapps · php · Verified

Impact

Multiple cross-site scripting (XSS) vulnerabilities in usercp.php in MyBulletinBoard (MyBB) 1.02 allow remote attackers to inject arbitrary web script or HTML via the (1) notepad parameter in a notepad action and (2) signature parameter in an editsig action. NOTE: These are different attack vectors, and probably a different vulnerability, than CVE-2006-0218 and CVE-2006-0219.

Affected products

Weakness classification

References

• NVD record
• CVE.org record
• http://kapda.ir/advisory-241.html
• http://secunia.com/advisories/18603
• http://securitytracker.com/id?1015535
• http://www.securityfocus.com/archive/1/423128/100/0/threaded
• http://www.securityfocus.com/bid/16361
• http://www.vupen.com/english/advisories/2006/0316
• http://kapda.ir/advisory-241.html
• http://secunia.com/advisories/18603
• http://securitytracker.com/id?1015535
• http://www.securityfocus.com/archive/1/423128/100/0/threaded
• http://www.securityfocus.com/bid/16361
• http://www.vupen.com/english/advisories/2006/0316