SF-Users V1.0 XSS injection

2006.05.04
Risk: Low
Local: No
Remote: Yes
CWE: CWE-79


CVSS Base Score: 4.3/10
Impact Subscore: 2.9/10
Exploitability Subscore: 8.6/10
Exploit range: Remote
Attack complexity: Medium
Authentication: No required
Confidentiality impact: None
Integrity impact: Partial
Availability impact: None

SF-Users V1.0 XSS injection Discovered by: Nomenumbra Date: 5/2/2006 impact:moderate (privilege escalation,possible defacement) The username with which you sign up isn't properly sanitized so it's possible to insert some javascript there. The single quote is filtered so we'll have to use ' or %27. A username like this: <IMG SRC=javascript:alert(%27!%27)> would be displayed on the user page as XSS, the rest is left to your fantasy. Nomenumbra/[0x4F4C]


Vote for this issue:
50%
50%


 

Thanks for you vote!


 

Thanks for you comment!
Your message is in quarantine 48 hours.

Comment it here.


(*) - required fields.  
{{ x.nick }} | Date: {{ x.ux * 1000 | date:'yyyy-MM-dd' }} {{ x.ux * 1000 | date:'HH:mm' }} CET+1
{{ x.comment }}

Copyright 2017, cxsecurity.com

 

Back to Top