SquirrelMail Virtual Keyboard Plugin – ‘vkeyboard.php’ Cross-Site Scripting

Exploit Database
118 阅读

作者： Moritz Naumann

日期： 2010-10-05
类别：
- webapps
平台：
- php
来源：https://www.exploit-db.com/exploits/34814/

source: https://www.securityfocus.com/bid/43749/info

The Virtual Keyboard plugin for SquirrelMail is prone to a cross-site scripting vulnerability because it fails to properly sanitize user-supplied input.

An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may allow the attacker to steal cookie-based authentication credentials and to launch other attacks.

Virtual Keyboard 0.9.1 and prior are vulnerable.

http://www.example.com/plugins/vkeyboard/vkeyboard.php?passformname=%22%3E%3Cscript%3Ealert%28%27XSS%27%29;%3C/script%3E%3Cscript%3E/*%20

last Exploits
SquirrelMail Virtual Keyboard Plugin – ‘vkeyboard.php’ Cross-Site Scripting的更多信息

Royal TS/X – Information Disclosure：
SQLBuddy 1.3.3 – Directory Traversal：
Tugux CMS 1.0_final – Multiple Vulnerabilities：
Joomla! Component com_sectionex 2.5.96 – SQL Injection：
Composr 10.0.36 – Remote Code Execution：
Joomla! Component CW Tags 2.0.6 – SQL Injection：
CMS Made Simple < 2.2.10 - SQL Injection：
sNews 1.7 – ‘index.php?category’ SQL Injection：