15 lines
No EOL
842 B
Text
15 lines
No EOL
842 B
Text
# Exploit Title: SHOUTcast DNAS v2.2.1 win32 XSS\HTML Injection in Song history (other version may be also affected)
|
||
# Date: 2014-06-11
|
||
# Exploit Author: robercik101
|
||
# Vendor Homepage: http://www.shoutcast.com/ ?t=373139
|
||
# Software Link: http://forums.winamp.com/showthread.php?t=373139
|
||
# Version: 2.2.1 for Win32
|
||
# Tested on: Windows 8.1
|
||
There is an XSS\HTML Injection in a song history in song history, allowing inject a JavaScript script or HTML code in site.
|
||
PoC:
|
||
1. Open yours MP3 file setting, and open details overlap.
|
||
2. In the title field enter your HTML code
|
||
3. Start streaming your MP3 file via Winamp with SHOUTcast Source DSP
|
||
4. Open your SHOUTcast page (default: localhost:8000) in your favourite Internet browser, login to server (if it needed) and open Song history.
|
||
And it is all
|
||
http://robercik101.tk |