medium6.8Public exploit code

CVE-2006-5770

Multiple cross-site scripting (XSS) vulnerabilities in ac4p Mobile allow remote attackers to inject arbitrary web script or HTML via (1) Bloks, (2) Newnews, (3…

Public exploit code

Working exploit or proof of concept code has been published for this vulnerability. Treat unpatched systems as at risk.

ac4p Mobile - '/cp/index.php?pagenav' Cross-Site Scripting2006-11-03 · webapps · php · Verified
ac4p Mobile - 'up.php' Multiple Cross-Site Scripting Vulnerabilities2006-11-03 · webapps · php · Verified
ac4p Mobile - 'send.php?cats' Cross-Site Scripting2006-11-03 · webapps · php · Verified
ac4p Mobile - 'polls.php' Multiple Cross-Site Scripting Vulnerabilities (1)2006-11-03 · webapps · php · Verified
ac4p Mobile - 'MobileNews.php' Multiple Cross-Site Scripting Vulnerabilities2006-11-03 · webapps · php · Verified
ac4p Mobile - 'index.php' Multiple Cross-Site Scripting Vulnerabilities2006-11-03 · webapps · php · Verified

Impact

Multiple cross-site scripting (XSS) vulnerabilities in ac4p Mobile allow remote attackers to inject arbitrary web script or HTML via (1) Bloks, (2) Newnews, (3) lBlok, and (4) foooot parameter in (a) index.php; Newnews, (5) newmsgs, and Bloks parameter in (b) MobileNews.php; Newnews parameter in (c) polls.php; (6) cats parameter in (d) send.php; (7) footer parameter in (e) up.php; and (8) pagenav parameter in (f) cp/index.php.

Affected products

Vendor	Product	Affected versions
Ac4p	Ac4p Mobile	All versions

Public exploit code

Impact

Affected products

References