Search
1.
(Code/Joomla!)
JComments 2.2.0.0 suffers from a persistent XSS vulnerability in the way it handles certain BBCodes.
If [url] and [img] tags are available, the following malformed BBCode will result in code execution: ...
2.
(Code/Joomla!)
Since the CompojoomComment Hacking Contest is now over, and I was the only winner, I figured I'd go ahead and share my winning entries. These vulnerabilities are present in CompojoomComment 4.1.5, and ...
3.
(Code/Joomla!)
Compojoom, developers of CompojoomComment, opened up a contest to hack their comment component. After being alerted to the contest by my good friend Lafrance, I took a peek and had a working XSS exploit ...
4.
(Code/Joomla!)
The Joomla component Lyften Bloggie was recently exposed to suffer from an SQL Injection vulnerability. Since I had a current client that was running this software, with no fix in sight, I decided to take ...
5.
(Code/Joomla!)
The Joomla component Ninjaboard 0.5.0beta suffers from multiple persistent XSS vulnerabilities in its BBCode implementation, as well as a minor CSRF vulnerability and a minor Path Disclosure vulnerability. ...
6.
(Code/Joomla!)
webee 1.1.1, a Joomla commenting plugin, suffers from multiple vulnerabilities.
SQL Injection
The 'articleId' is not sanitized.
index2.php?option=com_webeecomment&task=default&articleId=999 union ...
7.
(Code/Joomla!)
Joomla Commentator 1.1b3, a Joomla commenting plugin, suffers from an XSS vulnerability in its "title" field that enables attackers to possibly run scripts as an administrator.
title"/onmouseover="alert(/xss/.source)
Timeline ...
8.
(Comments/All)
Jeff, thank you for your help in resolving this issue for me. I still don't think the whole how-to should have been posted, but I do agree with making people aware that there IS a vulnerability. Now that ...
9.
(Comments/All)
When the developer doesn't care to fix it, is it better to know a vulnerability exists, or to be in the dark and let someone else find it?
Take a look yourself: this was posted in April 2009, and an ...
10.
(Comments/All)
It's one thing to say, hey, there's a vulnerability here, I should let the developer know so they can fix it. It's another thing entirely to just post a step-by-step manual on how to exploit the vulnerability, ...
11.
(Code/Joomla!)
The Joomla component AWD Wall 1.5 suffers from an SQL Injection vulnerability in its handling of the 'cbuser' parameter.
?option=com_awdwall&view=awdwall&cbuser=62 and 1=1 limit 1 -- '
?option=com_awdwall&view=awdwall&cbuser=62 ...
12.
(Other/Other)
... IMG Tag Injection
This is basically the IMG Tag injection above with a twist: using nested tags to achieve the injection. This is based off the vulnerability found by Julian A. Rodriguez affecting Phorum. ...
13.
(Code/Joomla!)
The Joomla component EasyBook 2.0.0rc4 suffers from multiple persistent XSS vulnerabilities. One seems fairly critical, while the others would take some incredible creativity to actively exploit.
BBCode ...
14.
(Code/Joomla!)
The Joomla component ccBoard 1.1-RC suffers from a Cross Site Scripting vulnerability if certain conditions are met. The forum must be set up to use the internal HTML editor and not bbCode. This is the ...
15.
(Code/Joomla!)
... in the page twice.
"><script>alert(document.cookie)</script><b f="
AIM Profile Field XSS
This vulnerability has a limited number of characters, but this will inject ...
16.
(Code/Joomla!)
The Joomla component Rapid Forum suffers from a persistent XSS vulnerability.
This vulnerability is pretty easy to exploit, as Rapid Forum does absolutely no validation or encoding whatsoever.
<script>alert(document.cookie)</script>
Timeline ...
17.
(Code/Joomla!)
The Simplest Forum BBCode Plugin 1.0.0 Beta 2 for Joomla suffers from a persistent XSS vulnerability that allows arbitrary injections of CSS rules.
[color=#FF0000;font-size:100px]XSS[/color]
Timeline ...
18.
(Code/Joomla!)
The Joomla component Testimonial Ku 2.0 is vulnerable to persistent XSS in the administrator panel. A malicious user can submit a testimonial containing <script> tags with absolutely no quotes and ...
19.
(Code/Joomla!)
... XSS vulnerability executes in the administrator area as well.
[color] BBCode Tag XSS
[color=red;font-size:expression(alert(String.fromCharCode(88,83,83)))]XSS[/color]
This XSS vulnerability executes ...
20.
(Code/Joomla!)
... is coupled with an SQL injection vulnerability introduced by a third party script, it would be trivial for an attacker to take control of an administrative account on the victim's site. The process would ...
Latest Articles
Jeff ChannellCart
Your Cart is currently empty.
Keywords
Template Info
-
Name
Circles -
Creation Date
06/28/09 -
Author
Jeff Channell -
Author Email
me@jeffchannell.com -
Author URL
http://jeffchannell.com -
Version
0.0.2 -
Description
Circles