ATutor 1.6.4 – Multiple Cross-Site Scripting Vulnerabilities

Exploit Database
83 阅读

作者： ITSecTeam

日期： 2010-03-11
类别：
- webapps
平台：
- php
来源：https://www.exploit-db.com/exploits/11685/

Topic : ATutor 1.6.4
Bugs Type : Cross Site Scripting (all of them)
Credit : ItSecTeam
Remote : Yes
Status : Bug

# mail : Bug@ItSecTeam.com
# Dork : "ATutor 1.6.4"
#Special Tnx : am!rkh@n, Amin Shokohi(Pejvak), C0M0D0, 0xd41684c654, r3dmove And All It Security Team Members
#Website : WwW.ITSecTeam.com

########################## Exploit #############################
the bugs can be explited as below:

#1: After logging in as an instructor go to manage section and add a poll and inject your XSS code as a questaion or choices.
#2: After logging in as an instructor go to manage section and Create a new Group and inject your XSS code as title or group type.
#3: After logging in as an instructor go to manage section and Add an Assignment with XSS code as title.

last Exploits
ATutor 1.6.4 – Multiple Cross-Site Scripting Vulnerabilities的更多信息

PageDirector CMS – Multiple Vulnerabilities：
PHP Lowbids – ‘viewfaqs.php’ Blind SQL Injection：
FLIR Thermal Camera PT-Series (PT-334 200562) – Root Remote Code Execution：
Yachtcontrol Webapplication 1.0 – Unauthenticated Remote Code Execution：
e107 0.7.23 – Multiple SQL Injections：
Citadel WebCit < 926 - Session Hijacking Exploit：
dalbum 1.43 – Multiple Vulnerabilities：
pfSense 2.2 – Multiple Vulnerabilities：