bugtraq - YaPiG thanks_comment.php Cross-Site Scripting Vulnerability

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite for Android: free password hash cracker in your pocket

[<prev] [next>] [day] [month] [year] [list]

Message-ID: <20060825104733.25077.qmail@securityfocus.com>
Date: 25 Aug 2006 10:47:33 -0000
From: Kuon_at_Armorize_dot_com@...this.domain
To: bugtraq@...urityfocus.com
Subject: YaPiG thanks_comment.php Cross-Site Scripting Vulnerability

/*  
    Kuon <Armorize Security Team>

    Kuon-[at]-Armorize.com

    YaPiG thanks_comment.php Cross-Site Scripting Vulnerability

    Contact : Kuon-[at]-Armorize.com

    Link : www.Armorize.com
*/

Armorize Technologies Security Advisory

Advisory No: 20061001
Date: 2006/08/25

Affected Software: 
yapig 0.95b

Vulnerability Description: 
Cross-Site Scripting Vulnerability

Detection/Exploit:
http://www.example.com/[PATH]/template/default/thanks_comment.php?D_REFRESH_URL=[XSS]

Disclosure Timeline:
2006/08/17

Armorize Technologies provides next-generation source code analysis tools to help developers identify and remediate vulnerabilities in their web application source. CodeSecure™, Armorize’s premier source code analysis tool is available for analysis of PHP, JSP and ASP. Find out more at www.armorize.com .