torrenttrader-xss.txt

`Cross-site Scripting and CSRF in TorrentTrader Classic v1.08  
  
Application: TorrentTrader Classic v1.08, possible other versions.  
  
Vendor URL:   
http://sourceforge.net/project/showfiles.php?group_id=98584&package_id=1809271.  
  
1. Input passed to the msg property of account-inbox.php is not properly  
sanitized before being displayed to the user. A malicious authenticated user  
can execute arbitrary HTML and scripting code in a user's browser session in  
context of an affected web site.  
Example:  
http://[host]/account-inbox.php?msg=<script>alert(document.co­okie)</script>&receiver=<username>  
  
2. The application allows users to perform certain actions via HTTP requests  
without performing any validity checks to verify the request. A malicious  
person can perform a CSRF attack.  
Example:  
http://[host]/account-inbox.php?msg=<message>&receiver=<username>  
  
Vulnerability #1 was discovered by Dominus.  
Original URL: http://www.securitylab.ru/vulnerability/347887.php  
  
BR,  
Valery Marchuk  
www.SecurityLab.ru  
  
`