bugtraq - IBSng all version Cross-Site Scripting Vulnerability

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite for Android: free password hash cracker in your pocket

[<prev] [next>] [day] [month] [year] [list]

Message-Id: <201111010533.pA15XJoo031696@sf01web1.securityfocus.com>
Date: Tue, 1 Nov 2011 05:33:19 GMT
From: apa-iutcert@...c.ir
To: bugtraq@...urityfocus.com
Subject: IBSng all version Cross-Site Scripting Vulnerability

================= APA-IUTcert =================
Title: IBSng all version Cross-Site Scripting Vulnerability
Vendor: www.parspooyesh.com
Type: Cross-Site Scripting Vulnerability
Fix: N/A

================== nsec.ir =================
Description:
Input passed via the "str" parameter to IBSng/util/show_multistr.php is not properly sanitised before being returned to the user. This can be exploited to execute arbitrary HTML and script code in a user's browser session in context of an affected site.
This bug can be exploited by malicious people with out any privilege access to conduct cross-site scripting attacks.

PoC : http://[target]/IBSng/util/show_multistr.php?str=[xss]

Original Advisory : http://nsec.ir/

Credit: Isfahan University of Technology - Computer Emergency Response Team