Arcadwy Arcade Script - Username Static Cross-Site Scripting

2009-03-27T00:00:00
ID EXPLOITPACK:ED67132A4E347DDCD0DCEAB4A6742D84
Type exploitpack
Reporter Anarchy Angel
Modified 2009-03-27T00:00:00

Description

Arcadwy Arcade Script - Username Static Cross-Site Scripting

                                        
                                            #################################\
# Information          
# Script                 : Arcadwy Arcade Script CMS             
# Buy/Download   : http://arcadwy.com/                           
# Vulnerability      : Static XSS                                          
# Discovered by    : Anarchy Angel                                    
# Contact              : anarchy[dot]ang31 [@] gmail           
# Website              : http://hha.zapto.org                           
# Greets                : Xteaphn, lun0s, BSDgurl, progenic.  
\#################################/

[!] EXPLOIT
    1) Go to http://site.com/register.php
    2) In username field input XSS payload
    3) Fill in the rest of the fields and submit.
    4) Activate account!

Every time the accounts username is shown on the site the XSS will run.
Usernames show in comments, game scores, and so on.

[!] FIX: Sanitize all input from the registers page form.

# milw0rm.com [2009-03-27]