full-disclosure - Cross Site Scripting fusion news

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Message-ID: <BAY8-F100pNwqeq5Z3J00017e0e@hotmail.com>
From: k1ll3rb0y at hotmail.com (k1LL3r B0y)
Subject: Cross Site Scripting fusion news


=====================================================================
========================== DarkBicho ================================

    	PROGRAM: fusion news
	HOMEPAGE: http://www.fusionphp.net/
	version: 3.6.1
	Bug: Cross Site Scripting
	Date:  22/04/2003
	Author: DarkBicho
		web: http://www.darkbicho.tk
		Email: darkbicho@...u.com

=====================================================================

===============
1) Introduction
===============

fusion news is sofware free in php, This product is vulnerable to the
Cross-Site Scripting vulnerability that would allow attackers to inject
HTML and script codes into the pages and execute it on the client's
browser as if it were provided by the site.


===============
2) Exploit
===============

The XSS hole is in fullnews.php

http://site 
vulnerable/fullnews.php?id=<script>alert(document.cookie);</script>



===============
2) SOLUTION
===============

the vendor was notified visits web site for patch




=====================================================================
DARKBICHO
www.darkbicho.tk
Made In Peru

advisore url: http://bichosoft.webcindario.com/advisory-02.txt

_________________________________________________________________
MSN Amor: busca tu ? naranja http://latam.msn.com/amor/