Thyme 1.3 Cross Site Scripting

Edit Report

Our sensors found this exploit at: http://cxsecurity.com/ascii/WLB-2006050020

Below is a copy:

#----------------------------------------------------------

#Aria-Security.net Advisory

#Discovered  by: O.U.T.L.A.W

#< www.Aria-security.net>

#Gr33t to: A.u.r.a  & [email protected] & Smok3r

#-----------------------------------------------------------

? Software: Thyme 1.3

? Link: http://www.extrosoft.com/products/thyme/demo/index.php

? Attack method: Cross Site Scripting

? advisory:http://www.aria-security.net/portals/thyme

? Summary:

Thyme is a calendar system

?Description

A Remote User Can Steal the sessioncookie by searing <script>alert(document.cookie)</script><!-- in search page

? Solution

contact me: Advisory (at) Aria-Security (dot) net [email concealed]

All trademarks used are properties of their respective owners. By visiting this website you agree to Terms of Use.