http://badWebMasters.net

ben moeckel security research

-------------------------------------------------

badWebMasters security advisory #017

Cross Site Scripting @ PHP-Kit

Discovery date: 2003-09

Original advisory:

http://badwebmasters.net/advisory/017/ (text/html)

Legal Notice:

Copyright 2003 by Benjamin Klimmek (ben moeckel - badWebMasters)!

You may distribute it unmodified.

You may not modify it and distribute it or distribute parts of it

without giving credits and the URL where the original advisory can be

found!

This document may change without notice.

Author:

ben moeckel (http://distressed.de)

mailto: badwebmasters (at) online (dot) de [email concealed]

Description:

PHPKIT is a Nuke-a-like portal written in PHP.

The contact-formular is prone to several cross site scripting

vulnerabilities.

Exploit:

http://phpkit.de/include.php

?path=contact.php&contact_email="><script>alert(123);</script&g
t;

Vendor:

I posted a notice on the board (http://www.phpkit.de) a while ago.

Feedback:

Comments, suggestions, updates, anything else?

-> mailto:badwebmasters (at) online (dot) de [email concealed]

__________________________________________

badWebMasters - ben moeckel security research

http://badwebmasters.de http://badwebmasters.net

copyright 2k1-3 by Benjamin Klimmek / Germany

mailto:badwebmasters (at) online (dot) de [email concealed]

[ reply ]