|
Neohapsis is currently accepting applications for employment. For more information, please visit our website www.neohapsis.com or email hr@neohapsis.com |
EJ3 TOPo - Cross Site Scripting Vulnerability
mail
yunusemreyilmaz.com
Date: Tue Feb 28 2006 - 10:31:35 CST
- Messages sorted by: [ date ] [ thread ] [ subject ] [ author ]
- Advisory: EJ3 TOPo Cross Site Scripting Vulnerability
- Author: Yunus Emre Yilmaz || Yns [mailyunusemreyilmaz.com]
- Application: EJ3 TOPo ( http://ej3soft.ej3.net )
- Affected Version : v2.2.178 ( maybe older versions..)
- Risk : Critical
– Details : If an attacker access /code/inc_header.php directly , he can bypass $gTopNomBer variable.(Register_globals must be “on”)
Problem is about not defining or filtering the variable.
– Proof Of Concept : access /code/inc_header.php like
inc_header.php?gTopNombre=“><script>alert(document.cookie)</script>
and print user’s cookie.So an attacker can escape admin’s cookie.
– Release Date: 2006/02/28
– Contacted to vendor : 2006/02/28
- Messages sorted by: [ date ] [ thread ] [ subject ] [ author ]