PassMasterFlex (and PassMasterFlex+) XSS injection=0D
=0D
Discovered by: Nomenumbra=0D
Date: 5/4/2006=0D
impact:moderate (privilege escalation,possible defacement)=0D
=0D
=0D
PassMasterFlex(+) is a database-driven multiple login that utilizes cookies for authentication.=0D
PassMasterFlex+ was written not only to provide an alternative to the Apache login but in =0D
response to numerous requests to have multiple users.=0D
=0D
PMF doesn't filter any data in the user's profiles, thus allowing them to embed any XSS code there=0D
to elevate their privileges.=0D
Also upon failed login attempt, data gets written to the "hack-log" but without filtering. It is=0D
possible to embed XSS in a custom user-agent to obtain cookies.=0D
=0D
Nomenumbra/[0x4F4C]