lists.openwall.net   lists  /  announce  owl-users  owl-dev  john-users  john-dev  passwdqc-users  yescrypt  popa3d-users  /  oss-security  kernel-hardening  musl  sabotage  tlsify  passwords  /  crypt-dev  xvendor  /  Bugtraq  Full-Disclosure  linux-kernel  linux-netdev  linux-ext4  linux-hardening  linux-cve-announce  PHC 
Open Source and information security mailing list archives
 
Hash Suite: Windows password security audit tool. GUI, reports in PDF.
[<prev] [next>] [day] [month] [year] [list]
Message-ID: <20060407060128.32014.qmail@securityfocus.com>
Date: 7 Apr 2006 06:01:28 -0000
From: king_purba@...oo.co.uk
To: bugtraq@...urityfocus.com
Subject: Multiple vulnerability in jupiter CMS


Author : KaDaL-X
email : king_purba@...oo.co.uk
site : http://kandangjamur.net/

Multiple vulnerability in jupiter CMS
Vendor : http://www.highstrike.net/
version 1.1.5

Vulnerability code found in file modules/online.php

PoC:

XSS
http://xxx/jupiter/jupiter/index.php?n=modules/online&&a=1&language=1&layout=%3Ch1%3E%3Cmarquee%3Ealooo

FIX:
Create a validation function to fix the bugs, you can use htmlspecialchars() function to fix this security issue

Full Path disclosure
http://xxxx/jupiter/jupiter/modules/online.php

FIX:
Turn off display error

Note :
Sorry, but vendor site is also vuln with this bugs


Powered by blists - more mailing lists

Powered by Openwall GNU/*/Linux Powered by OpenVZ