header-logo
Suggest Exploit
vendor:
E107
by:
MustLive
8.8
CVSS
HIGH
Cross-Site Scripting
79
CWE
Product Name: E107
Affected Version From: E107 0.7.16
Affected Version To: Previous versions
Patch Exists: YES
Related CWE: N/A
CPE: e107
Metasploit: N/A
Other Scripts: N/A
Tags: N/A
CVSS Metrics: N/A
Nuclei References: N/A
Nuclei Metadata: N/A
Platforms Tested: N/A
2009

Cross-Site Scripting vulnerability in E107

At page for sending news to email (http://site/email.php?news.1) it's possible to conduct XSS attack via Referer header. Particularly it can be done via flash. Referer: '><script>alert(document.cookie)</script> Vulnerable are E107 0.7.16 and previous versions (all versions).

Mitigation:

Input validation and output encoding should be used to prevent XSS attacks.
Source

Exploit-DB raw data:

Hello Bugtraq!

I want to warn you about Cross-Site Scripting vulnerability in E107. Which I
found at 31.01.2009 and disclosed recently.

XSS:

At page for sending news to email (http://site/email.php?news.1) it's
possible to conduct XSS attack via Referer header. Particularly it can be
done via flash.

Referer: '><script>alert(document.cookie)</script>

Vulnerable are E107 0.7.16 and previous versions (all versions).

I mentioned about this vulnerability at my site
(http://websecurity.com.ua/3528/).

Best wishes & regards,
MustLive
Administrator of Websecurity web site
http://websecurity.com.ua

Navigation

Suggest Exploit

Services By CQR