BugTraq
Kongreg8 1.7.3 Mutiple XSS Feb 25 2012 01:33AM
Thomas Richards (g13net gmail com)
# Exploit Title: Kongreg8 1.7.3 Mutiple XSS
# Date: 02/24/12
# Author: G13
# Software Link: https://sourceforge.net/projects/kongreg8/
# Version: 1.7.3
# Category: webapps (php)
#

##### Vulnerability #####

Kongreg8 1.7.3 has multiple XSS vulnerabilites. These vulnerabilities
are in the Add Member and Add Group functions. These are presistent
XSS vulnerabilities.

The script command can be added right on the page; there is no client
or server side validation on these fields.

##### Vendor Notification #####

02/19/12 - Vendor Notified
02/24/12 - Disclosure

##### Affected Variables #####

Add Member:

surname=[XSS]
firstname=[XSS]

Add Group:

groupdescription=[XSS]
groupname=[XSS]

[ reply ]


 

Privacy Statement
Copyright 2010, SecurityFocus