AneCMS 1.3 – Persistent Cross-Site Scripting

• Exploit Database
• 11 阅读

• 作者： Penguin
  日期： 2011-01-17
• 类别：

  • webapps
  平台：

  • php
• 来源：https://www.exploit-db.com/exploits/16007/

• # Exploit Title: AneCMS 1.3 Persistant XSS
  # Date: 17.1.2011
  # Author: Penguin
  # Visit: www.null-sector.info
  # Software Link: http://anecms.com/anecms.zip
  # Version: 1.3
  # Tested on: Linux
  
  (I) Vulnerability
  ----------------------
  You can add blogpost comments that does not get filtered for HTML-Code.
  Simply add an Comment with for example the Content <script>alert(1337);</script>
  Your <script> code will get executed by every visitor who reads the comments!
  
  (II) Bug Fix
  ----------------------
  There's no Bugfix :)