← back
CVE-2005-0670

CVE-2005-0670

EPSS 4.4%
Cross-site scripting (XSS) vulnerability in phpCOIN 1.2.0 through 1.2.1b allows remote attackers to inject arbitrary web script or HTML via (1) the new parameter to mod.php, (2) the w parameter to mod.php, (3) the e parameter to login.php, (4) the o parameter to login.php, and possibly other scripts.
Affected products
n/a · n/a
public PoCs found — 2
exploitdbwww.exploit-db.com/exploits/25175unverifiedexploitdbwww.exploit-db.com/exploits/25174unverified
⚠ Public resources, to assess the exposure of systems you control or are authorized to test. Test only with authorization.

Want to know if your infrastructure is exposed to this?

Talk to TrueHacking →
References
http://forums.phpcoin.com/index.php?showtopic=4101http://forums.phpcoin.com/index.php?showtopic=4116http://forums.phpcoin.com/index.php?showtopic=4118http://lostmon.blogspot.com/2005/03/phpcoin-posible-sql-injection-comands.htmlhttp://secunia.com/advisories/14439http://securitytracker.com/id?1013329https://exchange.xforce.ibmcloud.com/vulnerabilities/19572http://www.securityfocus.com/bid/12686