Kongreg8 1.7.3 Mutiple XSS

2012-03-19T00:00:00
ID SECURITYVULNS:DOC:27808
Type securityvulns
Reporter Securityvulns
Modified 2012-03-19T00:00:00

Description

Exploit Title: Kongreg8 1.7.3 Mutiple XSS

Date: 02/24/12

Author: G13

Software Link: https://sourceforge.net/projects/kongreg8/

Version: 1.7.3

Category: webapps (php)

Vulnerability

Kongreg8 1.7.3 has multiple XSS vulnerabilites. These vulnerabilities are in the Add Member and Add Group functions. These are presistent XSS vulnerabilities.

The script command can be added right on the page; there is no client or server side validation on these fields.

Vendor Notification

02/19/12 - Vendor Notified 02/24/12 - Disclosure

Affected Variables

Add Member:

surname=[XSS] firstname=[XSS]

Add Group:

groupdescription=[XSS] groupname=[XSS]