Lucene search

K
securityvulnsSecurityvulnsSECURITYVULNS:DOC:17280
HistoryJun 18, 2007 - 12:00 a.m.

PhpListPro Persistent XSS Vulnerability

2007-06-1800:00:00
vulners.com
18

-=[--------------------ADVISORY-------------------]=-

                 phpListPro 

Author: CorryL [[email protected]]
-=[-----------------------------------------------]=-

-=[+] Application: phpListPro
-=[+] Version: 2.0.1
-=[+] Vendor's URL: http://www.smartisoft.com/
-=[+] Platform: Windows\Linux\Unix
-=[+] Bug type: Persistent Cross-Site Script
-=[+] Exploitation: Remote
-=[-]
-=[+] Author: CorryL ~ corryl80[at]gmail[dot]com ~
-=[+] Reference: http://corryl.altervista.org/
-=[+] Irc Chan: irc.darksin.net #x0n3-h4ck

…::[ Proof Of Concept ]::…

PhplistPro is affected from a called bug persistent XSS,
in practice the script doesn't filter the information
that have passed through form for the application
of insertion of a web site, allowing a remote attacker
to insert a script xss and to draw information from all the people that access the page.

…::[ Exploit ]::…

download exploit from my private area in my web site:

http://corryl.altervista.org/index.php?mod=Area_Privata