Description
Multiple cross-site scripting (XSS) vulnerabilities in F@cile Interactive Web 0.8.5 and earlier allow remote attackers to inject arbitrary web script or HTML via the (1) lang parameter in index.php, and the (2) mytheme and (3) myskin parameters in multiple "p-themes" index.inc.php files including (c) lowgraphic, (d) classic, (e) puzzle, (f) simple, and (g) ciao. NOTE: vectors 2 and 3 might be resultant from file inclusion issues.
Public exploits
Exploit or proof-of-concept code for this vulnerability is publicly available, which lowers the bar for attackers. Treat it as a reason to patch sooner.
Third-party code, not reviewed by us. Public PoCs are sometimes fake or contain malware. Read the code first and run it only in an isolated lab, against systems you are authorised to test.
Exploit-DB 1
- F@cile Interactive Web 0.8x - Remote File Inclusion / Cross-Site Scripting EDB-1841 · webapps · May 28, 2006 · verified
Sources: PoC-in-GitHub, Metasploit Framework, Exploit-DB — updated daily. Only links are listed; no exploit code is hosted here.
References
- 20060528 Advisory: F@cile Interactive Web <= 0.8x Multiple RemoteVulnerabilities. mailing-list
- http://www.nukedx.com/?viewdoc=35
- ADV-2006-2036 vdb-entry
- 26105 vdb-entry
- http://www.nukedx.com/?getxpl=35
- 18151 vdb-entry
- 26104 vdb-entry
- 20358 third-party-advisory
- 1010 third-party-advisory