bugtraq - Multitple XSS Vulnerabilities in Red Mombin 0.7

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite for Android: free password hash cracker in your pocket

[<prev] [next>] [day] [month] [year] [list]

Message-ID: <20060928011015.15671.qmail@securityfocus.com>
Date: 28 Sep 2006 01:10:15 -0000
From: security@...orize.com
To: bugtraq@...urityfocus.com
Subject: Multitple XSS Vulnerabilities in Red Mombin 0.7

Armorize Technologies Security Advisory

Advisory No:
Armorize-ADV-2006-0002

Date:
2006/9/22

Summary:
Armorize-ADV-2006-0002 discloses multiple cross-site scripting vulnerabilities that are found in Red Mombin, which is a quick and easy-to-use web-base task manager. It's powered by AJAX, PHP, and MySQL and works in all major browsers.

Affected Software:
Red Mombin 0.7

Vulnerability Description:
Cross-Site Scripting

Analysis/Impact:
Privacy leakages from the client-side may lead to session hijacking, identity theft and information theft.

Detection/Exploit(partial):
http://www.example.com/[PATH]/index.php
http://www.example.com/[PATH]/process_login.php

Protection/Solution:
1. Escape every questionable URI and HTML script.
2. Remove prohibited user input.

Credit: Security Team at Armorize Technologies, Inc. (security@...orize.com)

Additional Information:
Link to this Armorize advisory,
http://www.armorize.com/advisory.php?Keyword=Armorize-ADV-2006-0002

Links to all Armorize advisories,
http://www.armorize.com/advisory/

Links to Armorize vulnerability database,
http://www.armorize.com/resources/vulnerability.php

Armorize Technologies is a software security company focused on Web application security. Our source code analysis tools provide Web application security that transcends firewalls, intrusion detection systems (IDSs), and all other signature-based security devices. Armorize's main product, CodeSecure, uses award-winning and patent-pending source code verification technology to identify vulnerabilities in Web applications during the earliest stage of the software development lifecycle.

Papers on source code analysis technology from our founding team have won awards at two consecutive International World Wide Web Conferences. The latest version of CodeSecure addresses current market gaps in Web security products by helping Web developers detect vulnerabilities and choose from rapidly generated solutions. The company is headquartered in Santa Clara, California with its R&D center in Taipei, Taiwan. Find out more at http://www.armorize.com.