[<prev] [next>] [day] [month] [year] [list]
Message-ID: <FBCMMO02HWhobqVObE80003fd32@FBCMMO02.fbc.local>
Date: Fri, 15 Jun 2007 22:25:58 +0200
From: <corrado.liotta@...ce.it>
To: <full-disclosure@...ts.grok.org.uk>
Subject: PhpListPro Persistent XSS Vulnerability
-=[--------------------ADVISORY-------------------]=-
phpListPro
Author: CorryL [corryl80@...il.com]
-=[-----------------------------------------------]=-
-=[+] Application: phpListPro
-=[+] Version: 2.0.1
-=[+] Vendor's URL: http://www.smartisoft.com/
-=[+] Platform: Windows\Linux\Unix
-=[+] Bug type: Persistent Cross-Site Script
-=[+] Exploitation: Remote
-=[-]
-=[+] Author: CorryL ~ corryl80[at]gmail[dot]com ~
-=[+] Reference: http://corryl.altervista.org/
-=[+] Irc Chan: irc.darksin.net #x0n3-h4ck
..::[ Proof Of Concept ]::..
PhplistPro is affected from a called bug persistent XSS,
in practice the script doesn't filter the information
that have passed through form for the application
of insertion of a web site, allowing a remote attacker
to insert a script xss and to draw information from all the people that access the page.
..::[ Exploit ]::..
download exploit from my private area in my web site:
http://corryl.altervista.org/index.php?mod=Area_Privata
Content of type "text/html" skipped
_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/
Powered by blists - more mailing lists