CVE-2008-7057

Affected software: BandSite CMS 1.1.4. Vulnerability: Cross-site scripting (XSS) in merchandise.php, exploitable via the type parameter. Root cause / note: Malicious HTML/script can be injected into the page by manipulating the type parameter. Documents do not specify a concrete exploit string or...

CVE-2008-7057: Improper Neutralization of Input During Web Page Generation

Cross-site scripting XSS vulnerability in merchandise.php in BandSite CMS 1.1.4 allows remote attackers to inject arbitrary HTML or web script via the type parameter...

bandsitecms-xss.txt

BandSite CMS 1.1.4 Arbitrary Download Database/XSS/CSRF + Discovered By SirGod + www.mortal-team.org + Greetz : E.M.I.N.E.M,Ras,Puscasmarin,ToxicBlood,MesSiAH,xZu,HrN + Arbitrary Download Database Go to http://localhost/Path/adminpanel/phpmydump.php and the download will begin database.sql . +...