HLstats v1.35 - Cross-Site Scripting Vulnerability #3

discovered by John">href="http://john-martinelli.com">John Martinelli of RedLevel">href="http://redlevel.org">RedLevel Security

 
Google d0rk: "generated">href="http://www.google.com/search?q=%22generated+in+real-time+by+hlstats%22">"generated in real-time by HLstats" 





file hlstats.php - variable authusername - method post

action="http://www.target.com/hlstats/hlstats.php?mode=admin&act_sort=description&act_sortorder=asc&weap_sort=code&weap_sortorder=asc" method="post"> 








file hlstats.php - variable authpassword - method post

action="http://www.target.com/hlstats/hlstats.php?mode=admin&act_sort=description&act_sortorder=asc&weap_sort=code&weap_sortorder=asc" method="post">