Home / exploits

PDF

phpMyNewsletter 0.8 Cross Site Scripting

Posted on 03 December 2012

HTTPCS Advisory : HTTPCS116

Product : phpMyNewsletter

Version : v0.8

Page : /admin/?page=subscribers

Variables : page=[VulnHTTPCS]

Type : XSS

Method : POST

Description : A vulnerability has been discovered in phpMyNewsletter, which can
be exploited by malicious people to conduct cross-site scripting attacks. Input
passed via the 'page' parameter to '/admin/?page=subscribers' is not properly
sanitised before being returned to the user. This can be exploited to execute
arbitrary HTML and script code in a user's browser session in context of an
affected site.

References : https://www.httpcs.com/advisory/httpcs116

Credit : HTTPCS [Web Vulnerability Scanner]

 

TOP