KnowledgeTree 3.5.2 Community Edition – Persistent Cross-Site Scripting

Exploit Database
103 阅读

作者： fdiskyou

日期： 2010-08-11
类别：
- webapps
平台：
- php
来源：https://www.exploit-db.com/exploits/14622/

# Exploit Title: KnowledgeTree 3.5.2 Community Edition Permanent XSS Vulnerability

# Date: 2010-08-11

# Author: @fdiskyou

# e-mail: rui at deniable.org

# Software Link: http://www.knowledgetree.com/products/community/download

# Version: 3.5.2

# Notes: Fixed in the last version.

Go to search box or search criteria, enter your javascript code and save your search.

These searches can be shared with all the users enabling us to insert malicious javascript code.

POC:

Load http://localhost/dashboard.php or http://localhost/search2.php?action=searchResults in the textbox enter <script>alert('moo')</script> and save your search.

Load saved searches to view result.

last Exploits
KnowledgeTree 3.5.2 Community Edition – Persistent Cross-Site Scripting的更多信息

FanUpdate 3.0 – ‘pageTitle’ Cross-Site Scripting：
AneCMS – ‘/registre/next’ SQL Injection：
WordPress Plugin All in One SEO Pack 2.3.6.1 – Persistent Cross-Site Scripting：
WordPress Plugin Marketplace 2.4.0 – Arbitrary File Download：
Joomla! Component com_gcalendar Suite 2.1.5 – Local File Inclusion：
Beauty Parlour & SPA Saloon Management System – Blind SQL Injection：
Hikvision IP Camera versions 5.2.0 – 5.3.9 (Builds 140721 < 170109) - Access Control Bypass：
PHPJabbers Appointment Scheduler 2.3 – Reflected XSS (Cross-Site Scripting)：