@lex Guestbook 4.0.1 : Full Path Disclosure & XSS

2006.12.06
Credit: Mr_kaliman
Risk: Medium
Local: No
Remote: Yes
CVE: CVE-2006-6279 | CVE-2006-6278
CWE: CWE-79

@lex Guestbook 4.0.1 -------------------- Vendor site: http://www.alexphpteam.com/ Product: @lex Guestbook 4.0.1 Vulnerability: Full Path Disclosure & XSS Credits: Mr_KaLiMaN Reported to Vendor: 24.11.06 Public disclosure: 30.11.06 Description: ------------ Full Path Disclosure: http://[victim]/[guestbook_path]/index.php?skin=[non-existent_skin] XSS: http://[victim]/[guestbook_path]/index.php?skin=[XSS]


See this note in RAW Version
Vote for this issue:
50%
50%


 

Thanks for you vote!


 

Thanks for you comment!
Your message is in quarantine 48 hours.

Comment it here.


(*) - required fields.  
{{ x.nick }} | Date: {{ x.ux * 1000 | date:'yyyy-MM-dd' }} {{ x.ux * 1000 | date:'HH:mm' }} CET+1
{{ x.comment }}
Copyright 2024, cxsecurity.com

 

Back to Top