Exploit Comersus Backoffice 4.x/5.0/6.0 - 'comersus_Backoffice_supportError.asp?error' Cross-Site Scripting

Exploiter

Хакер
34,644
0
18 Дек 2022
EDB-ID
26444
Проверка EDB
  1. Пройдено
Автор
_6MO_HACK
Тип уязвимости
WEBAPPS
Платформа
ASP
CVE
cve-2005-3397
Дата публикации
2005-10-31
Код:
source: https://www.securityfocus.com/bid/15251/info

Comersus BackOfficePlus and BackOfficeLite are prone to multiple input validation and information disclosure vulnerabilities.

The applications are prone to SQL injection attacks, information disclosure and multiple cross-site scripting attacks.

An attacker can exploit these vulnerabilities to retrieve sensitive and privileged information, gain access to the application as an administrative user and perform cross-site scripting attacks to retrieve cookie-based authentication credentials from victim users; other attacks are also possible. 

http://www.example.com/comersus/backofficePlus/comersus_backoffice_supportError.asp?error=<script>alert('vul');</script>
 
Источник
www.exploit-db.com

Похожие темы