jCore SQL Injection and Cross Site Scripting Vulnerabilities
BID:56102
Info
jCore SQL Injection and Cross Site Scripting Vulnerabilities
| Bugtraq ID: | 56102 |
| Class: | Input Validation Error |
| CVE: |
CVE-2012-4231 CVE-2012-4232 |
| Remote: | Yes |
| Local: | No |
| Published: | Oct 17 2012 12:00AM |
| Updated: | Oct 17 2012 12:00AM |
| Credit: | High-Tech Bridge Security Research Lab |
| Vulnerable: |
Istvan Petres Jcore 1.0pre |
| Not Vulnerable: | |
Exploit / POC
jCore SQL Injection and Cross Site Scripting Vulnerabilities
An attacker can exploit these issues through a browser. To exploit a cross-site scripting issue, the attacker must entice an unsuspecting victim to follow a malicious URI.
The following example URI is available:
http://www.example.com/admin/?path=%27%20onmouseover%3dalert%28document.cookie%29%20%27
An attacker can exploit these issues through a browser. To exploit a cross-site scripting issue, the attacker must entice an unsuspecting victim to follow a malicious URI.
The following example URI is available:
http://www.example.com/admin/?path=%27%20onmouseover%3dalert%28document.cookie%29%20%27
References
jCore SQL Injection and Cross Site Scripting Vulnerabilities
References:
References:
- jCore Homepage (jCore)
- Multiple vulnerabilities in jCore (High-Tech Bridge)