[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]
[Full-disclosure] Cross-Site Scripting vulnerability in E107
- To: <full-disclosure@xxxxxxxxxxxxxxxxx>
- Subject: [Full-disclosure] Cross-Site Scripting vulnerability in E107
- From: "MustLive" <mustlive@xxxxxxxxxxxxxxxxxx>
- Date: Thu, 24 Sep 2009 20:19:14 +0300
Hello Full-Disclosure!
I want to warn you about Cross-Site Scripting vulnerability in E107. Which I
found at 31.01.2009 and disclosed recently.
XSS:
At page for sending news to email (http://site/email.php?news.1) it's
possible to conduct XSS attack via Referer header. Particularly it can be
done via flash.
Referer: '><script>alert(document.cookie)</script>
Vulnerable are E107 0.7.16 and previous versions (all versions).
I mentioned about this vulnerability at my site
(http://websecurity.com.ua/3528/).
Best wishes & regards,
MustLive
Administrator of Websecurity web site
http://websecurity.com.ua
_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/