Home page logo
/

bugtraq logo Bugtraq mailing list archives

IBSng all version Cross-Site Scripting Vulnerability
From: apa-iutcert () nsec ir
Date: Tue, 1 Nov 2011 05:33:19 GMT

================= APA-IUTcert =================
Title: IBSng all version Cross-Site Scripting Vulnerability
Vendor: www.parspooyesh.com
Type: Cross-Site Scripting Vulnerability
Fix: N/A

================== nsec.ir =================
Description:
Input passed via the "str" parameter to IBSng/util/show_multistr.php is not properly sanitised before being returned to 
the user. This can be exploited to execute arbitrary HTML and script code in a user's browser session in context of an 
affected site.
This bug can be exploited by malicious people with out any privilege access to conduct cross-site scripting attacks.

PoC : http://[target]/IBSng/util/show_multistr.php?str=[xss]

Original Advisory : http://nsec.ir/

Credit: Isfahan University of Technology - Computer Emergency Response Team


  By Date           By Thread  

Current thread:
  • IBSng all version Cross-Site Scripting Vulnerability apa-iutcert (Nov 01)
[ Nmap | Sec Tools | Mailing Lists | Site News | About/Contact | Advertising | Privacy ]