|
|
| |
OpenAutoClassifieds is "a free, open source vehicle classifieds manager. Intended to be both easy to install and easy to administer, OpenAutoClassifieds uses PHP to drive a MySQL backend, thus creating a tool which is fast and flexible".
Cross-Site Scripting attacks in this PHP classifieds system can be exploited by malicious users to cause third party users to execute arbitrary HTML and/or JavaScript. |
| |
Credit:
The information has been provided by David Sopas Ferreira.
|
| |
Vulnerable systems:
* OpenAutoClassifieds version 1.0
The vulnerability is caused due to missing validation of input supplied to the "listing" parameter. This can be exploited by including arbitrary HTML or script code in the parameter, which will cause it to be executed in a user's browser session when viewed.
Example:
http://[victim]/openautoclassifieds/friendmail.php?listing=< script>alert(document.domain);</script>
|
|
|
