Bugtraq mailing list archives
Allons_voter Version 1.0 xss and admin votes
From: sn0oPy.team () gmail com
Date: 9 Feb 2007 23:25:58 -0000
* Allons_voter Version 1.0 xss and admin votes wihtout password * By : sn0oPy * Risk : medium * Dork : inurl:"Allons_voter" * exploit : Be admin : http://www.target.com/Allons_voter/menu.html replace it by http://www.target.com/Allons_voter/admin_ajouter.php or http://www.target.com/Allons_voter/admin_supprimer.php + inject any script on the admin add menu. * contact : sn0oPy () avenir-geopolitique net * greetz : [subzero], Avg Team(forums.avenir-geopolitique.net). Réference : http://forums.avenir-geopolitique.net/viewtopic.php?t=2641
Current thread:
- Allons_voter Version 1.0 xss and admin votes sn0oPy . team (Feb 10)