Home page logo
/

bugtraq logo Bugtraq mailing list archives

Addressbook v8.1.24.1 Group Name XSS
From: "Kenneth F. Belva" <ken () silverbackventuresllc com>
Date: Wed, 12 Dec 2012 10:15:00 -0700

Instructions.

After authentication, click on the Group tab at the top. Click on the
New Group Button on the group page.

For the group name (the first field) enter the following XSS test
string:

&lt;SCRIPT&gt;alert(String.fromCharCode(88,83,83))&lt;/SCRIPT&gt;


Then call the XSS string from the URL -- technically one calls the group
name -- through the group parameter as such:

http://[server]/index.php?group=%3CSCRIPT%3Ealert%28String.fromCharCode%2888%2C83%2C83%29%29%3C%2FSCRIPT%3E

I emailed the apparent author but did not receive a reply.


Ken
http://silverbackventuresllc.com


  By Date           By Thread  

Current thread:
  • Addressbook v8.1.24.1 Group Name XSS Kenneth F. Belva (Dec 13)
[ Nmap | Sec Tools | Mailing Lists | Site News | About/Contact | Advertising | Privacy ]
AlienVault