COMMAND

	PY-Livredor Cross Site Scripting & Script Injection Vulnerability

SYSTEMS AFFECTED

	PY-Livredor v1.0

PROBLEM

	Thanks  to  "Grégory"  Le  Bras  [gregory.lebras@security-corp.org]  aka
	GaLiaRePt advisory :
	
	 http://www.security-corp.org/index.php?ink=4-15-1
	
	 Version Française :
	
	 http://www.security-corp.org/advisories/SCSA-008-FR.txt
	
	A Cross-Site Scripting vulnerability  have  been  found  in  PY-Livredor
	which allow attackers to inject script codes into the guestbook and  use
	them on clients browser as if they were provided by the website.
	
	This Cross-Site Scripting  vulnerability  are  found  in  the  page  for
	posting messages (index.php)
	
	An attacker can input specially crafted  links  and/or  other  malicious
	scripts.
	
	
	EXPLOIT
	________________________________________________________________________
	
	A vulnerability was discovered in the  page  for  posting  messages,  at
	this adress :
	
	http://[target]/livredor/index.php
	
	The vulnerability is at the level of the interpretation of the  "titre",
	"Votre pseudo", "Votre e-mail", "Votre message" fields.
	
	Indeed, the insertion of a hostile code script in this  field  makes  it
	possible to a malicious user to carry out this script on  the  navigator
	of the visitors.
	
	The hostile code could be :
	
	[script]alert("Cookie="+document.cookie)[/script]
	
	(open a window with the cookie of the visitor.)
	
	(replace [] by <>)
	

SOLUTION

	None yet