Visit our newest sister site!
Hundreds of free aircraft flight manuals
Civilian • Historical • Military • Declassified • FREE!


TUCoPS :: Web :: CMS / Portals :: va1005.htm

Mambo 4.6.2 Full Version - Multiple Cross Site Scripting - By Khashayar Fereidani



Mambo 4.6.2 Full Version - Multiple Cross Site Scripting - By Khashayar Fereidani
Mambo 4.6.2 Full Version - Multiple Cross Site Scripting - By Khashayar Fereidani



----------------------------------------------------------------

Script : Mambo 4.6.2 Full & Older Versions

Type : Multiple Cross Site Scripting Vulnerabilities

Alert Level : Medium

----------------------------------------------------------------

Download From : http://surfnet.dl.sourceforge.net/sourceforge/mambo/MamboV4.6.2.zip 

----------------------------------------------------------------

Discovered by : Khashayar Fereidani

My Website : HTTP://FEREIDANI.IR 

Khashayar Fereidani Email : irancrash [ a t ] gmail [ d o t ] com

----------------------------------------------------------------

Cross Site Scripting Vulnerability 1 :

Vulnerable File : administrator/popups/index3pop.php

Vulnerable Line (5)  : <?php echo $mosConfig_sitename; ?> - Administration [Mambo]

Vulnerable Variable : mosConfig_sitename

For Example : http://Example/administrator/popups/index3pop.php?mosConfig_sitename= 

Attacker can hijack administrator cookie and session and login with they 

----------------------------------------------------------------

Cross Site Scripting Vulnerability 2 :

Vulnerable File : mambots/editors/mostlyce/jscripts/tiny_mce/filemanager/connectors/php/connector.php?

Vulnable Variable : Any Variable - You can set any variable ....

For Example set (hacker) variable : http://Example/mambots/editors/mostlyce/jscripts/tiny_mce/filemanager/connectors/php/connector.php?khashayar= 

you can set cross site scripting code in variable name : http://Example/mambots/editors/mostlyce/jscripts/tiny_mce/filemanager/connectors/php/connector.php?=Hello+Word 

----------------------------------------------------------------

                        Tnx : God

HTTP://IRCRASH.COM HTTP://FEREIDANI.IR 

----------------------------------------------------------------


TUCoPS is optimized to look best in Firefox® on a widescreen monitor (1440x900 or better).
Site design & layout copyright © 1986-2014 AOH