Joomla com_ambra Persistent Xss Vulnerability

=============================================
Joomla com_ambra Persistent Xss Vulnerability
=============================================


1-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=0
0     _                   __           __       __                     1
1   /' \            __  /'__`\        /\ \__  /'__`\                   0
0  /\_, \    ___   /\_\/\_\ \ \    ___\ \ ,_\/\ \/\ \  _ ___           1
1  \/_/\ \ /' _ `\ \/\ \/_/_\_<_  /'___\ \ \/\ \ \ \ \/\`'__\          0
0     \ \ \/\ \/\ \ \ \ \/\ \ \ \/\ \__/\ \ \_\ \ \_\ \ \ \/           1
1      \ \_\ \_\ \_\_\ \ \ \____/\ \____\\ \__\\ \____/\ \_\           0
0       \/_/\/_/\/_/\ \_\ \/___/  \/____/ \/__/ \/___/  \/_/           1
1                  \ \____/ >> Exploit database separated by exploit   0
0                   \/___/          type (local, remote, DoS, etc.)    1
1                                                                      1
0  [+] Site            : Inj3ct0r.com                                  0
1  [+] Support e-mail  : submit[at]inj3ct0r.com                        1
0                                                                      0
1               ##########################################             1
0               I'm Sid3^effects member from Inj3ct0r Team             1
1               ##########################################             0
0-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-==-=-=-1

Name : Joomla com_ambra Persistent Xss Vulnerability
Date : july 13,2010
Critical Level     : HIGH
vendor URL :http://www.dioscouri.com/
Google Dork : Powered by Ambra User Manager ,inurl:com_ambra
Author : Sid3^effects aKa HaRi
special thanks to : r0073r (inj3ct0r.com),L0rd CruSad3r,MaYur,MA1201,KeDar,Sonic,gunslinger_
greetz to :www.topsecure.net ,All ICW members and my friends :) luv y0 guyz
#######################################################################################################
Description
AMBRA Subscriptions (AS) has an integrated File Manager, so if you're selling digital downloads with your subscriptions, then you no longer

need a separate download manager with a complicated integration. Some of the features of our download manager include download logging with

user id and IP, assigning files to multiple categories (without having to make multiple copies of the file), and assigning content articles

as the descriptions of both categories and files.
#######################################################################################################
Xploit: Persistent Xss Vulnerability

The com_ambra has persistent xss vuln.
The attacker can insert the xss scritp in the "Describe yourself"option

Attack Pattern:">><marquee><h1>XSS3d By Sid3^effects</h1><marquee> once inserted goto check your profile.

DEMO URL :http://www.dioscouri.com/index.php?option=com_ambra&view=users

#######################################################################################################
# 0day no more
# Sid3^effects 



#  0day.today [2018-03-20]  #