OSEC

Neohapsis is currently accepting applications for employment. For more information, please visit our website www.neohapsis.com or email hr@neohapsis.com
 
Thyme 1.3 Cross Site Scripting

outlawaria-security.net
Date: Sat Apr 29 2006 - 02:29:05 CDT

#----------------------------------------------------------
#Aria-Security.net Advisory
#Discovered by: O.U.T.L.A.W
#< www.Aria-security.net>
#Gr33t to: A.u.r.a & R1D3N & Smok3r
#-----------------------------------------------------------
» Software: Thyme 1.3
» Link: http://www.extrosoft.com/products/thyme/demo/index.php
» Attack method: Cross Site Scripting
» advisory:http://www.aria-security.net/portals/thyme

» Summary:
Thyme is a calendar system

»Description
A Remote User Can Steal the sessioncookie by searing <script>alert(document.cookie)</script><!-- in search page

» Solution
contact me: AdvisoryAria-Security.net