Cross-Site Scripting vulnerability in E107 Sep 24 2009 05:18PM
MustLive (mustlive websecurity com ua)
Hello Bugtraq!

I want to warn you about Cross-Site Scripting vulnerability in E107. Which I
found at 31.01.2009 and disclosed recently.


At page for sending news to email (http://site/email.php?news.1) it's
possible to conduct XSS attack via Referer header. Particularly it can be
done via flash.

Referer: '><script>alert(document.cookie)</script>

Vulnerable are E107 0.7.16 and previous versions (all versions).

I mentioned about this vulnerability at my site

Best wishes & regards,
Administrator of Websecurity web site

[ reply ]


Privacy Statement
Copyright 2010, SecurityFocus