Jump to content

Search the Community

Showing results for tags '9.0.16'.

  • Search By Tags

    Type tags separated by commas.
  • Search By Author

Content Type


Forums

  • Informatii generale
    • Anunturi importante
    • Bine ai venit
    • Proiecte RST
  • Sectiunea tehnica
    • Exploituri
    • Challenges (CTF)
    • Bug Bounty
    • Programare
    • Securitate web
    • Reverse engineering & exploit development
    • Mobile security
    • Sisteme de operare si discutii hardware
    • Electronica
    • Wireless Pentesting
    • Black SEO & monetizare
  • Tutoriale
    • Tutoriale in romana
    • Tutoriale in engleza
    • Tutoriale video
  • Programe
    • Programe hacking
    • Programe securitate
    • Programe utile
    • Free stuff
  • Discutii generale
    • RST Market
    • Off-topic
    • Discutii incepatori
    • Stiri securitate
    • Linkuri
    • Cosul de gunoi
  • Club Test's Topics
  • Clubul saraciei absolute's Topics
  • Chernobyl Hackers's Topics
  • Programming & Fun's Jokes / Funny pictures (programming related!)
  • Programming & Fun's Programming
  • Programming & Fun's Programming challenges
  • Bani pă net's Topics
  • Cumparaturi online's Topics
  • Web Development's Forum
  • 3D Print's Topics

Find results in...

Find results that contain...


Date Created

  • Start

    End


Last Updated

  • Start

    End


Filter by number of...

Joined

  • Start

    End


Group


Website URL


Yahoo


Jabber


Skype


Location


Interests


Biography


Location


Interests


Occupation

Found 1 result

  1. # Exploit Title: ocPortal 9.0.16 Multiply XSS Vulnerabilities # Google Dork: "Copyright (c) ocPortal 2011 " # Date: 26-2-2015 # Exploit Author: Dennis Veninga # Vendor Homepage: http://ocportal.com/ # Vendor contacted: 22-2-2015 # Fix: http://ocportal.com/site/news/view/security_issues/xss-vulnerability-patch.htm # Version: 9.0.16 # Tested on: Firefox 36 & Chrome 38 / W8.1-x64 ocPortal -> Version: 9.0.16 Type: XSS Severity: Critical Info Exploit: There are MANY possibilities to execute XSS on the new released ocPortal. All XSS attacks are done by a new registered user, so no extra rights are given. It's all standard. ####################################################### Events/Calendar, vulnerable to XSS attack: URL: http://{target}/ocportal/cms/index.php?page=cms_calendar&type=ad Title & text field, enter XSS code in both fields. Somewhere else the title XSS is executed, and elsewhere the Text/info XSS code is executed. When entering an XSS attack, on the events page, when mouse-over the just made event, it also reproduces an XSS. URL: http://{target}/ocportal/index.php?page=calendar&type=misc&id=2015-02&view=month XSS Vulnerability on the events which ALSO affects the Admin Panel, when Admin visits the panel and wants to edit it. ####################################################### Poll, vulnerable to XSS-attack. URL: http://{yourwebsite}/ocportal/cms/index.php?page=cms_polls&type=ad Just fill some XSS-code into the fields. Publish and see the result ####################################################### Forum, vulnerable to XSS-attack URL: http://{target}/ocportal/forum/index.php?page=topics&type=new_topic&id=2 Creating a new topic with all the fields XSS-ed, performs the XSS attack when an user is browsing the homepage. This is happening when the active topics are shown on the index page. But on the forum page itself, it isn't working. ####################################################### New PT (private topic/private message), vulnerable to XSS-attack URL: http://{target}/ocportal/forum/index.php?page=topics&type=new_pt Now, because I got a new private message, this XSS is executed everywhere!! ####################################################### Source
×
×
  • Create New...