Related information

Web applications security vulnerabilities summary (PHP, ASP, JSP, CGI, Perl)

Engeman - SQL Injection Vulnerability (vendor url erratum)

From:	MustLive <mustlive_(at)_websecurity.com.ua>
Date:	24.09.2009
Subject:	Cross-Site Scripting vulnerability in E107

Hello 3APA3A!

I want to warn you about Cross-Site Scripting vulnerability in E107.

XSS:

At page for sending news to email (http://site/email.php?news.1) it's possible to conduct XSS
attack via Referer header. Particularly it can be done via flash.

Referer: '><script>alert(document.cookie)</script>

Vulnerable are E107 0.7.16 and previous versions (all versions).

I mentioned about this vulnerability at my site (http://websecurity.com.ua/3528/).

Best wishes & regards,
MustLive
Administrator of Websecurity web site
http://websecurity.com.ua