Bugtraq mailing list archives
Kongreg8 1.7.3 Mutiple XSS
From: Thomas Richards <g13net () gmail com>
Date: Fri, 24 Feb 2012 20:33:53 -0500
# Exploit Title: Kongreg8 1.7.3 Mutiple XSS # Date: 02/24/12 # Author: G13 # Software Link: https://sourceforge.net/projects/kongreg8/ # Version: 1.7.3 # Category: webapps (php) # ##### Vulnerability ##### Kongreg8 1.7.3 has multiple XSS vulnerabilites. These vulnerabilities are in the Add Member and Add Group functions. These are presistent XSS vulnerabilities. The script command can be added right on the page; there is no client or server side validation on these fields. ##### Vendor Notification ##### 02/19/12 - Vendor Notified 02/24/12 - Disclosure ##### Affected Variables ##### Add Member: surname=[XSS] firstname=[XSS] Add Group: groupdescription=[XSS] groupname=[XSS]
Current thread:
- Kongreg8 1.7.3 Mutiple XSS Thomas Richards (Feb 27)