medium4.3Public exploit code

CVE-2006-0894

Multiple cross-site scripting (XSS) vulnerabilities in NOCC Webmail 1.0 allow remote attackers to inject arbitrary web script or HTML via (1) the html_error_oc…

Public exploit code

Working exploit or proof of concept code has been published for this vulnerability. Treat unpatched systems as at risk.

NOCC 1.0 - 'html_bottom_table.php' Multiple Cross-Site Scripting Vulnerabilities2006-02-23 · webapps · php · Verified
NOCC 1.0 - 'no_mail.php?html_no_mail' Cross-Site Scripting2006-02-23 · webapps · php · Verified
NOCC 1.0 - 'filter_prefs.php?html_filter_select' Cross-Site Scripting2006-02-23 · webapps · php · Verified
NOCC 1.0 - 'error.php?html_error_occurred' Cross-Site Scripting2006-02-23 · webapps · php · Verified

Impact

Multiple cross-site scripting (XSS) vulnerabilities in NOCC Webmail 1.0 allow remote attackers to inject arbitrary web script or HTML via (1) the html_error_occurred parameter in error.php, (2) html_filter_select parameter in filter_prefs.php, (3) html_no_mail parameter in no_mail.php, the (4) page_line, (5) prev, and (6) next parameters in html_bottom_table.php, and the (7) _SESSION['nocc_theme'] parameter in footer.php.

Affected products

Vendor	Product	Affected versions
Nocc	Nocc	Version 1.0

Public exploit code

Impact

Affected products

References