ATK Persistent/Non persistent XSS Vulnerability

===============================================
ATK Persistent/Non persistent XSS Vulnerability
===============================================

1-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=0
0     _                   __           __       __                     1
1   /' \            __  /'__`\        /\ \__  /'__`\                   0
0  /\_, \    ___   /\_\/\_\ \ \    ___\ \ ,_\/\ \/\ \  _ ___           1
1  \/_/\ \ /' _ `\ \/\ \/_/_\_<_  /'___\ \ \/\ \ \ \ \/\`'__\          0
0     \ \ \/\ \/\ \ \ \ \/\ \ \ \/\ \__/\ \ \_\ \ \_\ \ \ \/           1
1      \ \_\ \_\ \_\_\ \ \ \____/\ \____\\ \__\\ \____/\ \_\           0
0       \/_/\/_/\/_/\ \_\ \/___/  \/____/ \/__/ \/___/  \/_/           1
1                  \ \____/ >> Exploit database separated by exploit   0
0                   \/___/          type (local, remote, DoS, etc.)    1
1                                                                      1
0  [+] Site            : Inj3ct0r.com                                  0
1  [+] Support e-mail  : submit[at]inj3ct0r.com                        1
0                                                                      0
1               ##########################################             1
0               I'm Sid3^effects member from Inj3ct0r Team             1
1               ##########################################             0
0-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-==-=-=-1

Name : ATK Persistent/Non persistent XSS Vulnerability
Date : August, 31 2010
Vendor Url : http://www.atk-framework.com/
Author : Sid3^effects aKa HaRi <shell_c99[at]yahoo.com>
Big hugs : Th3 RDX,Hanan_butt 
special thanks to : r0073r (inj3ct0r.com),L0rd CruSad3r,SeeMe,MaYur,MA1201,KeDar,Sonic,gunslinger_,Sn!pEr.S!Te,n4pst3rr
greetz to :www.topsecure.net ,trent Dillman,All ICW members and my friends :) luv y0 guyz
#######################################################################################################
Descrition: 

ATK is a special purpose framework, targeted at business applications. It allows you to build an application with very small amounts of code.
Its focus on business features makes it an excellent framework for HRM, CRM, data management and CMS type applications.
---------------------------------------------------------------------------------------------------------------
Bug : Persistent XSS : 
 The persistent xss exists in the following options available in the application
 
 *Department Add 
 and all fields which can be used to add data
 Attack pattern : '"--><script>alert(/w0Ot/)</script>

##############################################################################################################
Bug : Non Persistent XSS :
The persistent xss exists is in the search option 
###############################################################################################################
Solution: 
   N/a
###############################################################################################################
# 0day no more
# Sid3^effects 



#  0day.today [2018-01-10]  #