bugtraq - xss in w3-msql error page

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Date: 3 Jan 2008 14:11:28 -0000
From: vivek_infosec@...oo.com
To: bugtraq@...urityfocus.com
Subject: xss in w3-msql error page

A reflected xss flaw exists in the w3-msql error page.

google dork : "W3-mSQL Error!  -  Can't stat script file (/"

Just insert a script from the start of /

like if u get a URL like:- 

http://localhost/cgi-bin/w3-msql/journal/ijcd/index.html

and the error page output as :-

W3-mSQL Error!  -  Can't stat script file (/journal/ijcd/index.html)

u can try this:-

A reflected xss flaw exists in the w3-msql error page.

google dork : "W3-mSQL Error!  -  Can't stat script file (/"

Just insert a script from the start of /

like if u get a URL like:- 

http://localhost/cgi-bin/w3-msql/<script>alert('xss')</script>

to confirm the issue