Tracker: Bugs
Hi,
I am the autor of document "Snort, Apache, MYSQL, PHP, y BASE instalación
en Slackware" that you published two months ago.
I have discovered a two variables that are vulnerable to XSS( A1 - OWASP
).
In the page base_qry_main.php the variables sig%5B0%5D and sig%5B1%5D.
Introducing unexpectes values is able to inyect html code.
I send us two evidences:
1) In the first I inyected a script with shows the cookie of visitor.
2) In the second I inyected a html code for obtain a banner with text "XSS
Vulnerable" and a malware link to "http://www.download.com/troyan.exe".
Best Regards
Nobody/Anonymous ( nobody ) - 2007-09-24 14:18
9
Closed
Fixed
Sean Muller
Interface
None
Public
Comments ( 3 )
|
Date: 2009-06-05 13:00 <a href="<http://groups.google.com/group/buy-best-generic-valium>">buy |
|
Date: 2007-11-21 01:48
|
|
Date: 2007-10-13 20:37
|
Log in to comment.
Attached File ( 1 )
| Filename | Description | Download |
|---|---|---|
| XSS_BASE_001.JPG | XSS sample1 | Download |
Changes ( 7 )
| Field | Old Value | Date | By |
|---|---|---|---|
| status_id | Open | 2007-11-21 01:48 | samwise_diver |
| resolution_id | None | 2007-11-21 01:48 | samwise_diver |
| assigned_to | secureideas | 2007-11-21 01:48 | samwise_diver |
| close_date | - | 2007-11-21 01:48 | samwise_diver |
| priority | 5 | 2007-10-13 20:37 | secureideas |
| assigned_to | nobody | 2007-10-13 20:37 | secureideas |
| File Added | 246977: XSS_BASE_001.JPG | 2007-09-24 14:18 | nobody |
About SourceForge
Develop Software
Community
Copyright © 2010 Geeknet, Inc. All rights reserved. Terms of Use
