bugtraq - Pligg CMS 2.0.2

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Message-Id: <201504231230.t3NCUwqp010463@sf01web3.securityfocus.com>
Date: Thu, 23 Apr 2015 12:30:58 GMT
From: joelvarghese7@...il.com
To: bugtraq@...urityfocus.com
Subject: Pligg CMS 2.0.2 - Stored XSS

Hi Team,

#Affected Vendor: http://pligg.com/
#Date: 23/04/2015
#Discovered by: Joel Vadodil Varghese
#Type of vulnerability: Persistent XSS
#Tested on: Windows 8.1
#Product: Pligg CMS
#Version: 2.0.2
#Tested Link: http://localhost/pligg/admin/admin_page.php 

Description: Pligg CMS is a content management platform that powers tens of thousands of websites. It specializes in creating social publishing networks, where users submit and promote content similar to sites like Digg, Reddit, and Mixx.Pligg CMS is vulnerable to stored xss vulnerability. The parameter "page_title" and "page_content" are the vulnerable parameter which will lead to its compromise.

#Proof of Concept (PoC): "><img src="a.jpg" onerror="alert('XSS')"/>

-- 
Regards,

Joel V