[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]
IBSng all version Cross-Site Scripting Vulnerability
- To: bugtraq@xxxxxxxxxxxxxxxxx
- Subject: IBSng all version Cross-Site Scripting Vulnerability
- From: apa-iutcert@xxxxxxx
- Date: Tue, 1 Nov 2011 05:33:19 GMT
================= APA-IUTcert =================
Title: IBSng all version Cross-Site Scripting Vulnerability
Vendor: www.parspooyesh.com
Type: Cross-Site Scripting Vulnerability
Fix: N/A
================== nsec.ir =================
Description:
Input passed via the "str" parameter to IBSng/util/show_multistr.php is not
properly sanitised before being returned to the user. This can be exploited to
execute arbitrary HTML and script code in a user's browser session in context
of an affected site.
This bug can be exploited by malicious people with out any privilege access to
conduct cross-site scripting attacks.
PoC : http://[target]/IBSng/util/show_multistr.php?str=[xss]
Original Advisory : http://nsec.ir/
Credit: Isfahan University of Technology - Computer Emergency Response Team