Main Archive Page > Month Archives  > full-disclosure-uk archives

[Full-disclosure] ACG-PTP 1.0.6 index.php persistent XSS

From: bug squash <bugsquashr_at_nospam>
Date: Fri Aug 22 2008 - 15:23:20 GMT
To: full-disclosure@lists.grok.org.uk

###################################

ACG-PTP 1.0.6 index.php persistent XSS
###################################

Author: FatBack Mac and the BBQ gang
Link: http://www.discountedscripts.com/demos/acg-ptp/admin/index.php

Multiple persistent XSS in the admin panel -

Example:
Advertisment Packages
POST to "Category name" field

Credit/Debit Users:
POST to "Reason" Field

Add new FAQ entry:
POST to "FAQ question" and "FAQ answer"

etc....

GREETZ:
Tyler Trioxide, d00m3d! Chik3n hUnT3r 666, T4c0 b3LL cRu

############################################
PRAISE HEPHAESTUS *** PRAISE HEPHAESTUS
############################################

---

Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html Hosted and sponsored by Secunia - http://secunia.com/