Lucene search

K
securityvulnsSecurityvulnsSECURITYVULNS:DOC:19983
HistoryJun 06, 2008 - 12:00 a.m.

WEBAlbum <= 2.0 Remote Stored Cross Site Scripting Vulnerability

2008-06-0600:00:00
vulners.com
11

================================================================

WEBAlbum <= 2.0 Remote Stored Cross Site Scripting Vulnerability

================================================================

AUTHOR : CWH Underground
DATE : 5 June 2008
SITE : www.citec.us

#####################################################
APPLICATION : WEBAlbum
VERSION : <= 2.0
VENDOR : http://www.web-album.org/
DOWNLOAD : http://www.web-album.org/en/download/
#####################################################


 IMPACT: Stored XSS , XSRF , Defacing , etc...  

β€”Remote XSS Exploit [add comment section]β€”

Vulnerable in "add comment" section. That's can input HTML code Injection into comment box then
send to server.

URL : http://[TARGET]/[webalbum_PATH]/photo_add-c.php
POST Variable: comment –> XSS Vulnerabilities
POST Variable: id
POST Variable: category

##################################################################
Greetz: ZeQ3uL, BAD $ectors, Snapter, Conan, Win7dos, JabAv0C
##################################################################