CMS Mini 0.2.2 – ‘index.php’ Script Cross-Site Scripting

Exploit Database
115 阅读

作者： Netsparker

日期： 2012-10-19
类别：
- webapps
平台：
- php
来源：https://www.exploit-db.com/exploits/37968/

source: https://www.securityfocus.com/bid/56148/info

CMS Mini is prone to a cross-site scripting vulnerability because it fails to sufficiently sanitize user-supplied data.

An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may allow the attacker to steal cookie-based authentication credentials and launch other attacks.

CMS Mini 0.2.2 is vulnerable; other versions may also be affected.

http://www.example.com/view/index.php?path='%22--%3E%3C/style%3E%3C/script%3E%3Cscript%3Ealert(0x0000A3)%3C/script%3E&p=cms.guestbook&msg=Message%20sent

last Exploits
CMS Mini 0.2.2 – ‘index.php’ Script Cross-Site Scripting的更多信息

PRTG Network Monitor 18.2.38 – (Authenticated) Remote Code Execution：
Scratcher – SQL Injection / Cross-Site Scripting：
ActiveCollab 2.3.0 – Local File Inclusion / Directory Traversal：
Command School Student Management System – ‘/sw/admin_subjects.php?id’ SQL Injection：
StarVedia IPCamera IC502w IC502w+ v020313 – ‘Username’/Password Disclosure：
SnapGear Management Console SG560 3.1.5 – Cross-Site Request Forgery (Add Super User)：
Beat Websites – ‘id’ SQL Injection：
TP-Link TL-WR740N – Buffer Overflow ‘DOS’：