Информационная безопасность
[RU] switch to English


Дополнительная информация

  Cводка уязвимостей безопасности в Web-приложениях (PHP, ASP, JSP, CGI, Perl)

  [CVE-2012-5692] Invision Power Board <= 3.3.4 "unserialize(
)" PHP Code Execution Vulnerability

  PrestaShop <= 1.5.1 Persistent XSS

  NetCat CMS v5.0.1 - Multiple Web Vulnerabilities

  PG Dating Pro v1.0 CMS - Multiple Web Vulnerabilities

From:marcelavbx_(at)_gmail.com <marcelavbx_(at)_gmail.com>
Date:2 ноября 2012 г.
Subject:XSS in dokeos 2.1.1



#############################
Exploit Title : Dokeos  2.1.1 Multiple Cross-Site Scripting Vulnerabilities
Author:Marcela Benetrix
home:www.girlinthemiddle.net
Date: 10/17/12
version: 2.1.1
software link:www.dokeos.com


#############################
Dokeos description

Dokeos is an open source e-learning platform programmed in PHP, Javascript and HTML which provides different features: reports, mindmaps,documents, social network,etc.

##########################
XSS location

/main/auth/profile.php

At this page,  we have a form with many fields to fill in. 5 of them are vulnerable to PERSISTENT cross site scripting. The named fields are:

extra_phone
extra_street
extra_addressline2
extra_zipcode

Via post, we can send malicious code in order to steal cookies, access to sensitive  information, do a web application defacement to every single user that visits the poisoned profile.
##########################
Vendor Notification

10/13/2012   to: [email protected]  
10/23/2012  to: [email protected]
10/30/2012  No response, disclosure



О сайте | Условия использования
© SecurityVulns, 3APA3A, Владимир Дубровин
Нижний Новгород