medium6.8Public exploit code
CVE-2006-6447
Multiple cross-site scripting (XSS) vulnerabilities in Vt-Forum Lite 1.3 and 1.5 allow remote attackers to inject arbitrary web script or HTML via (1) the StrM…
Public exploit code
Working exploit or proof of concept code has been published for this vulnerability. Treat unpatched systems as at risk.
- Vt-Forum Lite 1.3 - 'vf_newtopic.asp' IFRAME Element Cross-Site Scripting2006-12-04 · webapps · asp · Verified
- Vt-Forum Lite 1.3 - 'vf_info.asp?StrMes' Cross-Site Scripting2006-12-04 · webapps · asp · Verified
Impact
Multiple cross-site scripting (XSS) vulnerabilities in Vt-Forum Lite 1.3 and 1.5 allow remote attackers to inject arbitrary web script or HTML via (1) the StrMes parameter in vf_info.asp and possibly (2) a URL in the SRC attribute of an IFRAME element that is submitted to vf_newtopic.asp.
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Vt-Forum | Vt-Forum Lite | Versions 1.3, 1.5 |
References
- NVD record
- CVE.org record
- http://secunia.com/advisories/23226
- http://securityreason.com/securityalert/2011
- http://www.securityfocus.com/archive/1/453452/100/0/threaded
- http://www.securityfocus.com/bid/21428
- http://www.vupen.com/english/advisories/2006/4850
- https://exchange.xforce.ibmcloud.com/vulnerabilities/30725
- http://secunia.com/advisories/23226
- http://securityreason.com/securityalert/2011
- http://www.securityfocus.com/archive/1/453452/100/0/threaded
- http://www.securityfocus.com/bid/21428
- http://www.vupen.com/english/advisories/2006/4850
- https://exchange.xforce.ibmcloud.com/vulnerabilities/30725