bugtraq - Advisory: ASPBB <= 0.52 (perform_search.asp) XSS vulnerability

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite for Android: free password hash cracker in your pocket

[<prev] [next>] [day] [month] [year] [list]

Message-ID: <20060528165506.9fibu7llbde88k8o@webmail.nukedx.com>
Date: Sun, 28 May 2006 16:55:06 +0300
From: Mustafa Can Bjorn IPEKCI <nukedx@...edx.com>
To: bugtraq@...urityfocus.com
Subject: Advisory: ASPBB <= 0.52 (perform_search.asp) XSS vulnerability


--Security Report--
Advisory: ASPBB <= 0.52 (perform_search.asp) XSS vulnerability
---
Author: Mustafa Can Bjorn "nukedx a.k.a nuker" IPEKCI
---
Date: 27/05/06 04:26 PM
---
Contacts:{
ICQ: 10072
MSN/Email: nukedx@...edx.com
Web: http://www.nukedx.com
}
---
Vendor: ASPBB (www.aspbb.org)
Version: 0.52 and prior versions must be affected.
About: Via this method remote attacker can make malicious links for  
clicking and
when victim clicks this links victim's browser would be inject with XSS.
Level: Harmless
---
How&Example:
GET -> http://[site]/perform_search.asp?search=">[XSS]
EXAMPLE ->  
http://[site]/perform_search.asp?search="><script>alert('X');</script>
---
Timeline:
* 27/05/2006: Vulnerability found.
* 27/05/2006: Contacted with vendor and waiting reply.