bugtraq - [bWM#017] Cross-Site-Scripting @ PHPKIT

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Message-ID: <20031106005227.19959.qmail@sf-www2-symnsj.securityfocus.com>
Date: 6 Nov 2003 00:52:27 -0000
From: ben moeckel <badwebmasters@...ine.de>
To: bugtraq@...urityfocus.com
Subject: [bWM#017] Cross-Site-Scripting @ PHPKIT

http://badWebMasters.net 
ben moeckel security research 
------------------------------------------------- 

badWebMasters security advisory #017 
Cross Site Scripting @ PHP-Kit 
Discovery date: 2003-09 

Original advisory:
http://badwebmasters.net/advisory/017/ (text/html) 

Legal Notice:
Copyright 2003 by Benjamin Klimmek (ben moeckel - badWebMasters)!
You may distribute it unmodified.
You may not modify it and distribute it or distribute parts of it
without giving credits and the URL where the original advisory can be
found!
This document may change without notice. 

Author:
ben moeckel (http://distressed.de)
mailto: badwebmasters@...ine.de 

Description: 
PHPKIT is a Nuke-a-like portal written in PHP.
The contact-formular is prone to several cross site scripting
vulnerabilities. 

Exploit:
http://phpkit.de/include.php
  ?path=contact.php&contact_email=">&lt;script&gt;alert(123);&lt;/script&gt;

Vendor: 
I posted a notice on the board (http://www.phpkit.de) a while ago.

Feedback:
Comments, suggestions, updates, anything else?
   -> mailto:badwebmasters@...ine.de 

__________________________________________

badWebMasters - ben moeckel security research
http://badwebmasters.de http://badwebmasters.net
copyright 2k1-3 by Benjamin Klimmek / Germany
mailto:badwebmasters@...ine.de