Arcade Trade Script XSS

2009-05-25 / 2009-05-26
Credit: SmOk3
Risk: Low
Local: No
Remote: Yes
CWE: CWE-79


Ogólna skala CVSS: 4.3/10
Znaczenie: 2.9/10
Łatwość wykorzystania: 8.6/10
Wymagany dostęp: Zdalny
Złożoność ataku: Średnia
Autoryzacja: Nie wymagana
Wpływ na poufność: Brak
Wpływ na integralność: Częściowy
Wpływ na dostępność: Brak

Original advisory: http://www.davidsopas.com/2009/05/25/arcade-trade-script-xss/ Arcade Trade Script is a full arcade site CMS (Content Management System) with easy customization and advanced traffic trading system built in. With ATS you will hardly ever have to FTP anything. Almost all files, pages, and meta tags can be edited from the admin panel. ATS is extremely easy to use and works for both regular arcades and full blown traffic trading arcades. - taken from Arcade Trade Script vendor website. This awesome script (version 1.0 beta) has a XSS vulnerability in one of it s variables, this attack could be used to grab peoples cookies or to launch denial of service attacks. PoC: index.php?a=gamelist&q=[XSS]&submit=GO The vendor was really fast, about a couple of hours, to patch it after I mailed him so just upgrade to a new version to have it fixed. It s always nice to see an admin who cares and answer positively to a possible security threat.


Vote for this issue:
50%
50%


 

Thanks for you vote!


 

Thanks for you comment!
Your message is in quarantine 48 hours.

Comment it here.


(*) - required fields.  
{{ x.nick }} | Date: {{ x.ux * 1000 | date:'yyyy-MM-dd' }} {{ x.ux * 1000 | date:'HH:mm' }} CET+1
{{ x.comment }}

Copyright 2024, cxsecurity.com

 

Back to Top