CMScout 2.08 – Cross-Site Scripting

Exploit Database
120 阅读

作者： XroGuE

日期： 2010-05-28
类别：
- webapps
平台：
- php
来源：https://www.exploit-db.com/exploits/34055/

source: https://www.securityfocus.com/bid/40442/info

CMScout is prone to a cross-site scripting vulnerability because the application fails to sufficiently sanitize user-supplied data.

An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may help the attacker steal cookie-based authentication credentials and launch other attacks.

The following example input to the 'search' field is available:

<marquee><font color=Blue size=15>XroGuE</font></marquee>

last Exploits
CMScout 2.08 – Cross-Site Scripting的更多信息

Elite Gaming Ladders 3.6 – SQL Injection：
Joomla! Component Acymailing Starter 5.9.5 – CSV Macro Injection：
Alcatel-Lucent Omnivista 8770 – Remote Code Execution：
MC Buy and Sell Cars Script 1.1 – SQL Injection：
phxEventManager 2.0 Beta 5 – ‘search.php’ search_terms SQL Injection：
WordPress Plugin Rating-Widget 1.3.1 – Multiple Cross-Site Scripting Vulnerabilities：
Bakeshop Inventory System in VB.Net and MS Access Database 1.0 – SQL Injection：
Gym Management System 1.0 – Stored Cross Site Scripting：