注册 登录  
 加关注
   显示下一条  |  关闭
温馨提示!由于新浪微博认证机制调整,您的新浪微博帐号绑定已过期,请重新绑定!立即重新绑定新浪微博》  |  关闭

Tetraph 的博客

IT 计算机网络信息安全技术 数学 统计 云计算 安全漏洞 日常随笔 散文 音乐

 
 
 

日志

 
 

【转载】Artnana Webboard version 1.4 XSS (Cross-site Scripting) Web Security Vulnerabilities  

2015-05-09 15:13:31|  分类: 转载 |  标签: |举报 |字号 订阅

  下载LOFTER 我的照片书  |
Artnana Webboard version 1.4 XSS (Cross-site Scripting) Web Security Vulnerabilities - whitehat - 白帽子安全漏洞
 


Artnana Webboard version 1.4 XSS (Cross-site Scripting) Web Security Vulnerabilities

 

Exploit Title: Artnana Webboard version 1.4 Multiple XSS Security Vulnerabilities

Product: Webboard

Vendor: Artnana

Vulnerable Versions: version 1.4

Tested Version: version 1.4

Advisory Publication: May 09, 2015

Latest Update: May 09, 2015

Vulnerability Type: Cross-Site Scripting [CWE-79]

CVE Reference: *

Impact CVSS Severity (version 2.0):

CVSS v2 Base Score: 4.3 (MEDIUM) (AV:N/AC:M/Au:N/C:N/I:P/A:N) (legend)

Impact Subscore: 2.9

Exploitability Subscore: 8.6

Writer and Reporter: Jing Wang [School of Physical and Mathematical Sciences (SPMS), Nanyang Technological University (NTU), Singapore] (@justqdjing)

 

 

 

Proposition Details:

(1) Vendor & Product Description:

Vendor:

Artnana

 

Product & Vulnerable Versions:

Webboard

version 1.4

 

Vendor URL & Download:

Webboard can be obtained from here,

http://www.artnana.com/web-d.php

 

Product Introduction Overview:

"Webboard is Thailand IT company that provide software service. Webboard can make your website easier and convenience. WebBoard is a discussion board where you post messages and participate in discussions with the other people in the course."

 

 

 

(2) Vulnerability Details:

Artnana Webboard web application has a computer security bug problem. It can be exploited by stored XSS attacks. This may allow a remote attacker to create a specially crafted request that would execute arbitrary script code in a user's browser session within the trust relationship between their browser and the server.

Several other Artnana products 0-day vulnerabilities have been found by some other bug hunter researchers before. Artnana has patched some of them. FusionVM? Vulnerability Management and Compliance provides sources for the latest info-sec news, tools, and advisories. It has published suggestions, advisories, solutions details related to XSS vulnerabilities.

 

(2.1) The first programming code flaw occurs at "&keyword" parameter in "search_topic.php?" page.

(2.2) The second programming code flaw occurs at "&keyword" parameter in "search_products.php" page.

 

 

 

 

References:

http://www.tetraph.com/security/xss-vulnerability/artnana-webboard-version-1-4-xss/

http://securityrelated.blogspot.com/2015/05/artnana-webboard-version-14-xss-cross.html

http://www.inzeed.com/kaleidoscope/computer-web-security/artnana-webboard-version-1-4-xss/

https://vulnerabilitypost.wordpress.com/2015/05/08/artnana-webboard-version-1-4-xss/

http://diebiyi.com/articles/%E5%AE%89%E5%85%A8/artnana-webboard-version-1-4-xss/

http://whitehatpost.blog.163.com/blog/static/24223205420154895051990/#

https://progressive-comp.com/?a=139222176300014&r=1&w=1?

https://www.fusionvm.com/FusionVM/DesktopModules/SecurityAdvisories/SecurityAdvisoriesView.aspx?Alias=www.fusionvm&TabId=0&Lang=en-US&OU=0&ItemId=44831

https://www.bugscan.net/#!/x/21221

http://bluereader.org/article/30765597

 
 
 



  评论这张
 
阅读(1)| 评论(0)
推荐 转载

历史上的今天

在LOFTER的更多文章

评论

<#--最新日志,群博日志--> <#--推荐日志--> <#--引用记录--> <#--博主推荐--> <#--随机阅读--> <#--首页推荐--> <#--历史上的今天--> <#--被推荐日志--> <#--上一篇,下一篇--> <#-- 热度 --> <#-- 网易新闻广告 --> <#--右边模块结构--> <#--评论模块结构--> <#--引用模块结构--> <#--博主发起的投票-->
 
 
 
 
 
 
 
 
 
 
 
 
 
 

页脚

网易公司版权所有 ©1997-2017