Joomla Rapid Recipe Persistent XSS Vulnerability

vendor:

Joomla Rapid Recipe

by:

Sid3^effects aKa HaRi

7,5

CVSS

HIGH

Persistent XSS

79 (Cross-site Scripting (XSS))

CWE

Product Name: Joomla Rapid Recipe

Affected Version From: N/A

Affected Version To: N/A

Patch Exists: N/A

Related CWE: N/A

CPE: N/A

Metasploit: N/A

Other Scripts: N/A

Tags: N/A

CVSS Metrics: N/A

Nuclei References: N/A

Nuclei Metadata: N/A

Platforms Tested: N/A

2010

Joomla Rapid Recipe Persistent XSS Vulnerability

The attacker can post their XSS script in the description area of the 'Add Recipe' option of the Joomla Rapid Recipe website. The attack pattern is '>><marquee><h1>XSS3d By Sid3^effects</h1><marquee>'

Mitigation:

Input validation and output encoding should be used to prevent XSS attacks.

Source

Exploit-DB raw data:

1               ##########################################             1
0               I'm Sid3^effects member from Inj3ct0r Team             1
1               ##########################################             0
0-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-==-=-=-1

Name : Joomla Rapid Recipe Persistent XSS Vulnerability
Date : july, 11 2010
Critical Level 	: HIGH
Vendor Url : http://www.rapid-source.com/
Author : Sid3^effects aKa HaRi <shell_c99[at]yahoo.com>
special thanks to : r0073r (inj3ct0r.com),L0rd CruSad3r,MaYur,MA1201,KeDar,Sonic,gunslinger_
greetz to :www.topsecure.net ,All ICW members and my friends :) luv y0 guyz 
#######################################################################################################
Xploit:Persistent Xss Vulnerability

Step 1 : Register

Step 2 : GOto "ADD RECIPE" option 

Demo Url:http://server/recipes/add-recipe.html

Step 3 : The attacker can post thier xss script in the description area.

Attack pattern : ">><marquee><h1>XSS3d By Sid3^effects</h1><marquee> 

Step 4 : Once done,go check your evil recipe ;).The location would be 
           
          http://site.com/recipes/[ur evil recipe name.html]

########################################################################################################
# 0day no more 
# Sid3^effects