[OpenLug] XSS

[Hetfield]

-=Quequero=- ha scritto:
> Appena arrivato, non so se quello che state montando e' vulnerabile cmq
> ecco l'adv:
>
> Release Date
> ------------
> June 01, 2006
>
> Vendor
> -------
> Two Shoes Mambo Factory
> http://www.tsmf.net/
>
> Version
> -------
> SimpleBoard 1.1.0 Stable (com_simpleboard) under Joomla CMS 1.0.8
>
> Details
> -------
> Frontend (Public):
> <forum_link> / <forum_title> / "post ne topic" / Name -> [XSS]
>
> If the module "mod_simpleboard5" wich shows the latest posts (also
> Username) is installed and aktivated for the frontpage (home), make
> <script>history.back();</script> and no one can join the page again!
>
> Backend (Admin Panel):
> Components /Simpleboard Forum / Simpleboard Configuration / Basics ->
> Title [XSS] (Community-Title)
>
> Components /Simpleboard Forum / Simpleboard Administration / New ->
> Name [XSS] (Forum-Title)
>
> Components /Simpleboard Forum / Simpleboard Administration / New ->
> Name [XSS] (Category-Title <- Choose "Top Level Category")
>
> XSS example: <script>alert("XSS");</script>
>
>
> ps
> Ma gli indirizzi di posta che utilizziamo, sono postati sul web? Perche'
> da tre giorni ricevo circa 20/30 mail di spam che spamassassin non becca
> e non riesco a capire da dove mi abbiano succhiato l'indirizzo :(
>
>   
> ------------------------------------------------------------------------
>
>
>   
si esatto sono in "chiaro"

controlla http://lists.linux.it/pipermail/openlug/2006-June/000303.html