BrowserCRM 5.100.1 – ‘framed’ Cross-Site Scripting

Exploit Database
121 阅读

作者： High-Tech Bridge SA

日期： 2011-12-14
类别：
- webapps
平台：
- php
来源：https://www.exploit-db.com/exploits/36451/

source: https://www.securityfocus.com/bid/51060/info

Browser CRM is prone to multiple SQL-injection vulnerabilities and multiple cross-site scripting vulnerabilities because it fails to sufficiently sanitize user-supplied data.

Exploiting these vulnerabilities could allow an attacker to steal cookie-based authentication credentials, compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database.

Browser CRM 5.100.01 is vulnerable; prior versions may also be affected.

http://www.example.com/licence/index.php?framed=%22%3E%3Cscript%3Ealert%28document.cookie%29;%3C/script%3E

last Exploits
BrowserCRM 5.100.1 – ‘framed’ Cross-Site Scripting的更多信息

Micronetsoft RV Dealer Website – SQL Injection：
Manx 1.0.1 – ‘/admin/tiny_mce/plugins/ajaxfilemanager_OLD/ajax_get_file_listing.php’ Multiple Cross-Site Scripting Vulnerabilities：
Joomla! Component com_seyret – Local File Inclusion：
GitLab – ‘impersonate’ Feature Privilege Escalation：
Mafya Oyun Scrpti – ‘profil.php’ SQL Injection：
1024 CMS 2.1.1 – ‘p’ SQL Injection：
Spitfire 1.0.381 – Cross-Site Scripting / Cross-Site Request Forgery：
Elastix 2.0.2 – Multiple Cross-Site Scripting Vulnerabilities：