AOH :: HP Unsorted D :: B06-5310.HTM

DEV Web Manager System <= 1.5 XSS Exploit



{x0n3-h4ck} DEV Web Manager System <= 1.5 XSS Exploit
{x0n3-h4ck} DEV Web Manager System <= 1.5 XSS Exploit



-=[--------------------ADVISORY-------------------]=-
-=[                                                                     ]=-
-=[        DEV Web Manager System <= 1.5          ]=-
-=[                                                                     ]=-
-=[ Author: CorryL [corryl80@gmail.com] ]=- 
-=[ www.x0n3-h4ck.org ]=- 
-=[----------------------------------------------------]=-


-=[+] Application:    DEV Web Manager System
-=[+] Version:        1.5
-=[+] Vendor's URL: http://dev-wms.sourceforge.net/ 
-=[+] Platform:       Windows\Linux\Unix
-=[+] Bug type:       cross-site script [XSS]
-=[+] Exploitation:   Remote
-=[-]
-=[+] Author:         CorryL  ~ corryl80[at]gmail[dot]com ~
-=[+] Reference: www.x0n3-h4ck.org 


..::[ Descriprion ]::..

DEV web manager system one application web based on php


..::[ Bug ]::..

this system e' affect from a bug of type XSS
a attaker to use the bug in order to steal sensitive information
to the users or admin


..::[ Proof Of Concept ]::..

http://web site/index.php?session=0&action=>">alert(775195196)%3B 


..::[ Workaround ]::..

Nothing

..::[ Disclousure Timeline ]::..

[07/10/2006] - Vendor notification
[11/10/2006] - Vendor Response
[17/10/2006] - No patch relase from vendor
[17/10/2006] - Public disclousure


The entire AOH site is optimized to look best in Firefox® 3 on a widescreen monitor (1440x900 or better).
Site design & layout copyright © 1986-2014 AOH
We do not send spam. If you have received spam bearing an artofhacking.com email address, please forward it with full headers to abuse@artofhacking.com.