Lucene search

K
securityvulnsSecurityvulnsSECURITYVULNS:DOC:12869
HistoryMay 30, 2006 - 12:00 a.m.

Advisory: ASPBB <= 0.52 (perform_search.asp) XSS vulnerability

2006-05-3000:00:00
vulners.com
8

–Security Report–
Advisory: ASPBB <= 0.52 (perform_search.asp) XSS vulnerability

Author: Mustafa Can Bjorn "nukedx a.k.a nuker" IPEKCI

Date: 27/05/06 04:26 PM

Contacts:{
ICQ: 10072
MSN/Email: [email protected]
Web: http://www.nukedx.com
}

Vendor: ASPBB (www.aspbb.org)
Version: 0.52 and prior versions must be affected.
About: Via this method remote attacker can make malicious links for
clicking and
when victim clicks this links victim's browser would be inject with XSS.
Level: Harmless

How&Example:
GET -> http://[site]/perform_search.asp?search=">[XSS]
EXAMPLE ->
http://[site]/perform_search.asp?search="><script>alert('X');</script>

Timeline:

  • 27/05/2006: Vulnerability found.
  • 27/05/2006: Contacted with vendor and waiting reply.