jPlayer – ‘Jplayer.swf’ Script Cross-Site Scripting

Exploit Database
138 阅读

作者： Malte Batram

日期： 2013-03-29
类别：
- webapps
平台：
- jsp
来源：https://www.exploit-db.com/exploits/38460/

source: https://www.securityfocus.com/bid/59030/info

jPlayer is prone to a cross-site scripting vulnerability because it fails to sufficiently sanitize user-supplied data.

An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may allow the attacker to steal cookie-based authentication credentials and launch other attacks.

http://www.example.com/Jplayer.swf?id=%3Cimg%20src=x%20onerror=alert\u0028\u0027moin\u0027\u0029%3E&jQuery=document.write

last Exploits
jPlayer – ‘Jplayer.swf’ Script Cross-Site Scripting的更多信息

thejshen Globitek CMS 1.4 – ‘id’ SQL Injection：
BloofoxCMS – ‘index.php’ Arbitrary File Upload：
Classified Ads Script PHP – ‘admin.php’ Multiple SQL Injections：
Membris 2.0.1 – Multiple Vulnerabilities：
Almnzm 2.1 – SQL Injection：
Joomla! Component com_weblinks – ‘id’ SQL Injection：
Factux – Local File Inclusion：
ZAPms 1.41 – SQL Injection：