Visit our newest sister site!
Hundreds of free aircraft flight manuals
Civilian • Historical • Military • Declassified • FREE!


TUCoPS :: Web :: Apps :: b06-3380.htm

ezWaiter v3.0 - XSS



ezWaiter v3.0 - XSS
ezWaiter v3.0 - XSS



ezWaiter v3.0=0D
=0D
Homepage:=0D
http://www.ezwaiter.com/=0D 
=0D
Affected files:=0D
=0D
Placing an order=0D
login.php=0D
-------------------------------------------=0D
=0D
XSS vuln when placing an order:=0D
=0D
User input is not sanatized before being generated. For a PoC in the two boxes labeled=0D
"Who is this item for?" and "Special Instructions:"=0D
=0D
put:=0D
=0D
=0D 
=0D
The login form found on login.php can be spoofed to remove the max char limits. It too doesn't sanatize data.=0D
=0D
---------------------------------------=0D


TUCoPS is optimized to look best in Firefox® on a widescreen monitor (1440x900 or better).
Site design & layout copyright © 1986-2014 AOH