• info
• discussion
• exploit
• solution
• references

INCOGEN Bugport Index.PHP Multiple Cross-Site Scripting Vulnerabilities

No exploit is required.

Example URI have been provided:

http://www.example.com/index.php?view=AddToFavoriteItemSetView&ids%5B0%5D=[XSS]
http://www.example.com/index.php?view=AddRelatedDevelopmentItemFormView&report_id=9&action=[XSS]
http://www.example.com/index.php?view=AddRelatedDevelopmentItemFormView&report_id=[XSS]
http://www.example.com/index.php?view=DevelopmentItemResultsView&devWherePair%5B0%5D=state_id+%3C+%3F++AND++MATCH+%28report%2Csubject%2Cdevelplan%2Cfixednotes%2Crepsteps%29+AGAINST+%28%3F++IN+BOOLEAN+MODE%29&devWherePair%5B1%5D%5B0%5D=240&devWherePair%5B1%5D%5B1%5D=[XSS]
http://www.example.com/index.php?view=DevelopmentItemResultsView&where=project_id+%3D+%3F&orderBy=priority_id+DESC&binds%5B0%5D=[XSS]