TangoBB 1.5.0-A3 Cross Site Scripting

2015.02.27

Credit: Dennis Veninga

Risk: Low

Local: No

Remote: Yes

CVE: N/A

CWE: CWE-79

Dork: \"Powered by TangoBB\"

# Exploit Title: TangoBB 1.5.0-A3 XSS Vulnerability
# Google Dork: "Powered by TangoBB"
# Date: 24-2-2015
# Exploit Author: Dennis Veninga
# Vendor Homepage: https://github.com/Codetana/TangoBB
# Version: 1.5.0-A3
# Tested on: Firefox 36 & Chrome 38 / W8.1-x64
# CVE : NONE

Published:            24-2-2015
Vendor updated:        24-2-2015

TangoBB ->
Version:            1.5.0-A3
Date:                24-2-2015
Found By:            Dennis Veninga
Exploit info:        XSS Vulnerability
Dork:                "Powered by TangoBB"

XSS:
http://{target}/TangoBB/new.php/node/1

Affects: created topic, so an user can infect other users with malware and or take over their systems.

References:

https://github.com/Codetana/TangoBB

See this note in RAW Version

Vote for this issue:

50%

Thanks for you vote!

Thanks for you comment!
Your message is in quarantine 48 hours.

Comment it here.

Nick (*)

Email (*)

Video

Text (*)

(*) - required fields.

{{ x.nick }} | Date: {{ x.ux * 1000 | date:'yyyy-MM-dd' }} {{ x.ux * 1000 | date:'HH:mm' }} CET+1

{{ x.comment }}

TangoBB 1.5.0-A3 Cross Site Scripting

Dork: \"Powered by TangoBB\"

References:

Thanks for you vote!

Thanks for you comment!Your message is in quarantine 48 hours.

Thanks for you comment!
Your message is in quarantine 48 hours.