{"hash": "6ac57921488fc96343cd13c23ebae18c9dc51ef16897b2d8f7387d5a0511e073", "edition": 1, "references": [], "objectVersion": "1.2", "viewCount": 0, "type": "packetstorm", "description": "", "bulletinFamily": "exploit", "href": "https://packetstormsecurity.com/files/109998/F-EX-20111129-2-Cross-Site-Scripting.html", "hashmap": [{"key": "bulletinFamily", "hash": "708697c63f7eb369319c6523380bdf7a"}, {"key": "cvelist", "hash": "d41d8cd98f00b204e9800998ecf8427e"}, {"key": "cvss", "hash": "d4be9c4fc84262b4f39f89565918568f"}, {"key": "description", "hash": "d41d8cd98f00b204e9800998ecf8427e"}, {"key": "href", "hash": "07fd2b6d41bbed35303be2decb3ff812"}, {"key": "modified", "hash": "64a24d7addd059730b11d3f2438d02b7"}, {"key": "objectVersion", "hash": "56765472680401499c79732468ba4340"}, {"key": "published", "hash": "64a24d7addd059730b11d3f2438d02b7"}, {"key": "references", "hash": "d41d8cd98f00b204e9800998ecf8427e"}, {"key": "reporter", "hash": "99aa5297ef86f4b206370a002526447c"}, {"key": "sourceData", "hash": "49b123a1636372eeb92c0b223b187989"}, {"key": "sourceHref", "hash": "f6e71961dec6a366e6565a26a668ea32"}, {"key": "title", "hash": "108f50d7def05493b338fe66098b80c8"}, {"key": "type", "hash": "6466ca3735f647eeaed965d9e71bd35d"}], "published": "2012-02-21T00:00:00", "modified": "2012-02-21T00:00:00", "title": "F*EX 20111129-2 Cross Site Scripting", "cvelist": [], "sourceHref": "https://packetstormsecurity.com/files/download/109998/fex201111292-xss.txt", "history": [], "reporter": "muuratsalo", "lastseen": "2016-11-03T10:27:40", "cvss": {"vector": "NONE", "score": 0.0}, "enchantments": {"score": {"value": 4.3, "vector": "NONE"}, "dependencies": {"references": [], "modified": "2016-11-03T10:27:40"}, "vulnersScore": 4.3}, "sourceData": "`------------------------------------------------------------------------ \nF*EX 20111129-2 Cross Site Scripting Vulnerability \n------------------------------------------------------------------------ \n \n \ntitle.............: F*EX 20111129-2 Cross Site Scripting Vulnerabilities \nauthor............: muuratsalo \ncontact...........: muuratsalo[at]gmail[dot]com \ndownload..........: http://fex.rus.uni-stuttgart.de/fex.html \ntested on.........: Debian wheezy - package fex_20111129-2_all.deb \n \n \n======================================================================== \n \nmuuratsalo | muuratsalo experimental hack lab is a proud member of the Revshell.com community \n \n======================================================================== \n \n[0x01] Software overview \n \nF*EX (Frams's Fast File EXchange) is a service (GPL software) that can be \nused to allow users anywhere on the Internet to exchange files of ANY size \nquickly and conveniently. The sender uploads the file to the F*EX-server \nand the recipient automatically gets a notification e-mail with a \ndownload-URL. The sender must be a registered user in opposite to the \nrecipient. \n \n======================================================================== \n \n[0x02] Vulnerabilities overview \n \nF*EX 20111129-2 suffers from a Cross Site Scripting attack (Reflected) in the WWW upload form. \n \n======================================================================== \n \n[0x03] Disclosure timeline \n \n[2012-02-01] - Multiple vulnerabilities discovered and reported to the author of the software. \n[2012-02-02] - The author confirmed the vulnerabilities and applied the suggested fixes. \n[2012-02-03] - Further analysis requested. \n[2012-02-13] - Very minor security hints applied. \n[2012-02-15] - F*EX major update - 20120215 \n[2012-02-20] - Public disclosure \n \n======================================================================== \n \n[0x04] Vulnerability \n \n------------------------------------------------------------------------ \n------------------------------------------------------------------------ \n \n*** Cross Site Scripting (Reflected) -- http://localhost:8888/fup [id parameter] *** \n \nGET /fup?id=38c66\"><script>alert(1)</script>b08f61c45c6&to=%0d&from=%0d HTTP/1.1 \n \n------------------------------------------------------------------------ \n------------------------------------------------------------------------ \n \n \n`\n", "id": "PACKETSTORM:109998"}

{}