Cross-site Scripting Cutenews

Full Version: Cross-site Scripting Cutenews

GovernmentSecurity.org > The Archives > Exploit Articles

qcred11

Jun 28 2004, 05:51 PM

QUOTE

PROGRAM: CuteNews
HOMEPAGE: http://cutephp.com/
VERSION: v1.3.1
BUG: Cross-Site Scripting
DATE: 23/05/2004
AUTHOR: DarkBicho

-----------------------------------------------------------------------------------------------

1.- Affected software description:
-----------------------------

CuteNews is a popular News Publishing, written in php by
CutePHP.

2.- Vulnerabilities:
---------------

A. Cross-Site Scripting aka XSS:

:.: In Id :
http://attacker/show_archives.php?subactio...rt_from=&ucat=&

http://attacker/show_news.php?subaction=sh...rt_from=&ucat=&

http://attacker/example1.php?subaction=sho...</script>

http://attacker/example2.php?subaction=sho...</script>

3.- SOLUTION:
¨¨¨¨¨¨¨¨
Vendors were contacted many weeks ago and plan to release a fixed
version soon.
Check the CuteNews website for updates and official release details.

4.- Greetings:
---------

greetings to my Peruvian group swp and perunderforce :D
"EL PISCO ES Y SERA PERUANO"

5.- Contact
-------

WEB: http://www.darkbicho.tk
EMAIL: darkbicho_at_peru.com

Source: http://seclists.org/lists/bugtraq/2004/Jun/0438.html

This is a "lo-fi" version of our main content. To view the full version with more information, formatting and images, please click here.