bugtraq - Youtube Clone Xross Site Scripting (load

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Date: 1 Feb 2008 21:34:50 -0000
From: ciucciamilcalzino@...ccazzamelo.it
To: bugtraq@...urityfocus.com
Subject: Youtube Clone Xross Site Scripting (load_message.php)

Discovered by Smasher
CMS: Youtube Clone Script
Site: http://warwolfz.altervista.org
WarWolfZ Security Crew.

Hello i don't know if this vuln is already out , but i've searched in securityfocus and is not present.

Bug found in load_message.php at line 4:

<?php echo $lang['please_wait']; ?>

Ex: http://localhost/youtube/siteadmin/editor_files/includes/load_message.php?lang[please_wait]=[XSS]

Fix:

<?php echo htmlspecialchars($lang['please_wait']); ?>

Greetz.
Smasher.