[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]
Cosmoshop - XSS on Admin-Login Mask
- To: bugtraq@xxxxxxxxxxxxxxxxx
- Subject: Cosmoshop - XSS on Admin-Login Mask
- From: innate@xxxxxx
- Date: Sat, 14 Feb 2015 15:14:22 GMT
author: l0om
page: l0om.org
date: 14.02.2015
Cosmoshop is a simple webshop designed for the german market.
There is a simple XSS flaw at the admin-login panel in probably all cosmoshop
versions. The admin login can be found at
http://www.shop-site.de/cgi-bin/cosmoshop/admin/index.cgi
This page will show a typical login screen. The username field is filled with
the value of "u_name". Since this parameter isn't filtered you can inject
javascript code and trick someone to execute it.
http://www.shop-site.de/cgi-bin/cosmoshop/admin/index.cgi?u_name=><script>alert("hello")</script>
nothing special but better to know.
Greetings and so long,
l0om