Bugtraqmailing list archives

By Date

By Thread

Vulnerabilities in Dataface Web Application Framework

Hello Bugtraq!I want to warn you about security vulnerabilities in Dataface WebApplication Framework.-----------------------------Advisory: Vulnerabilities in Dataface Web Application Framework-----------------------------URL:http://websecurity.com.ua/4276/-----------------------------Affected products: Dataface 1.0.-----------------------------Timeline:04.11.2009 - found vulnerabilities.10.06.2010 - announced at my site.11.06.2010 - informed developer.11.06.2010 - developer fixed these vulnerabilities in the latest version offramework and at his site.06.08.2010 - disclosed at my site.-----------------------------Details:These are Cross-Site Scripting and Full path disclosure vulnerabilities.XSS:http://site/admin.php?-table=pages&-search=%22%3E%3Cscript%3Ealert(document.cookie)%3C/script%3E&-action=search_indexFull path disclosure:http://siteVariable DATAFACE_PATH in body of all pages of the site.Best wishes & regards,MustLiveAdministrator of Websecurity web site

By Date

By Thread

Current thread:

• Vulnerabilities in Dataface Web Application FrameworkMustLive (Aug 06)