bugtraq - Re: chicomas <=2.0.4 Multiple Vulnerabilities

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite for Android: free password hash cracker in your pocket

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-ID: <Pine.LNX.4.64.0812202050370.15997@forced.attrition.org>
Date: Sat, 20 Dec 2008 20:55:01 +0000 (UTC)
From: security curmudgeon <jericho@...rition.org>
To: admin@...report.ir
Cc: bugtraq@...urityfocus.com
Subject: Re: chicomas <=2.0.4 Multiple Vulnerabilities


On Sat, 20 Dec 2008, admin@...report.ir wrote:

: +-->Cross Site Scripting (XSS). Reflected XSS attack in "index.php" in "q"
: parameter.
: 
: POC:
: http://[URL]/chicomas/index.php?q="<script>alert(/www.BugReport.ir/.source)</script>

This was disclosed on May 5th [1] by Hadi Kiamarsi and was assigned BID 
29025 / CVE-2008-2186 / OSVDB 44809.


- jericho

[1] http://marc.info/?l=bugtraq&m=120975560407192&w=2