Exploit e107 Website System 0.5/0.6 - 'Log.php' HTML Injection

Exploiter

Хакер
34,644
0
18 Дек 2022
EDB-ID
24138
Проверка EDB
  1. Пройдено
Автор
CHINCHILLA
Тип уязвимости
WEBAPPS
Платформа
PHP
CVE
cve-2004-2028
Дата публикации
2004-05-21
Код:
source: https://www.securityfocus.com/bid/10395/info

It is reported that e107 website system is prone to a remote HTML injection vulnerability. This issue is due to a failure by the application to properly sanitize user-supplied input.

The problem presents itself when a user supplies malicious HTML or script code to the application using a URI parameter of the log.php script. The application stores the injected HTML code, which is then rendered in the browser of an unsuspecting user whenever the log page of the affected site is viewed.

http://www.example.com/e107_plugins/log/log.php?referer=code<br>goes<here>&color=24&eself=http://www.example.com/stats.php&res=1341X1341
 
Источник
www.exploit-db.com

Похожие темы