Bug: Thyme 1.3 Cross Site Scripting ( Ascii Version )

Search:
WLB2

Thyme 1.3 Cross Site Scripting

Published
Credit
Risk
2006.05.02
O.U.T.L.A.W
Low
CWE
CVE
Local
Remote
CWE-79
CVE-2006-2117
No
Yes

CVSS Base Score
Impact Subscore
Exploitability Subscore
4.3/10
2.9/10
8.6/10
Exploit range
Attack complexity
Authentication
Remote
Medium
No required
Confidentiality impact
Integrity impact
Availability impact
Partial
None
None

#----------------------------------------------------------

#Aria-Security.net Advisory

#Discovered by: O.U.T.L.A.W

#< www.Aria-security.net>

#Gr33t to: A.u.r.a & R@1D3N & Smok3r

#-----------------------------------------------------------

? Software: Thyme 1.3

? Link: http://www.extrosoft.com/products/thyme/demo/index.php

? Attack method: Cross Site Scripting

? advisory:http://www.aria-security.net/portals/thyme

? Summary:

Thyme is a calendar system

?Description

A Remote User Can Steal the sessioncookie by searing <script>alert(document.cookie)</script><!-- in
search page

? Solution

contact me: Advisory (at) Aria-Security (dot) net [email concealed]

See this note in TXT Version

Bugtraq RSS
Bugtraq
 
REDDIT
REDDIT
 
DIGG
DIGG
 
LinkedIn
LinkedIn
 
CVE RSS
CVEMAP

Copyright 2014, cxsecurity.com
Ascii Version