Multiple XSS vulnerabilities in Bilboplanet application

vendor:

Bilboplanet

by:

Vivek N

8,8

CVSS

HIGH

Stored XSS

CWE

Product Name: Bilboplanet

Affected Version From: 2.0

Affected Version To: 2.0

Patch Exists: NO

Related CWE: N/A

CPE: a:bilboplanet:bilboplanet:2.0

Metasploit: N/A

Other Scripts: N/A

Tags: N/A

CVSS Metrics: N/A

Nuclei References: N/A

Nuclei Metadata: N/A

Platforms Tested: Windows

2013

Multiple XSS vulnerabilities in Bilboplanet application

Multiple stored XSS vulnerabilities exist in Bilboplanet application when creating and updating tribes, adding tags, and in parameters user_id and fullname.

Mitigation:

Input validation should be used to prevent XSS attacks.

Source

Exploit-DB raw data:

# Exploit Title: Multiple XSS vulnerabilities in Bilboplanet application
# Date: 10/15/13
# Exploit Author:Vivek N
# (http://nvivek.weebly.com/)
# Vendor Homepage: http://www.bilboplanet.com/
# Software Link: www.bilboplanet.com/index.php/downloads/?lang=en
# Version: 2.0
# Tested on: Windows
# CVE :

    1. Stored  XSS Vulnerability when creating and updating tribes  in
             http://localhost/bilboplanet/user/?page=tribes
             POST Parameter: tribe_name
    2. Stored XSS vulnerability when adding tag
            http://localhost/bilboplanet/user/?page=tribes
            POST Parameter: tags
    3. Stored XSS in parameters : user_id and fullname
            http://127.0.0.1/bilboplanet/signup.php