Monday, 7 January 2013

[EN] Wolf CMS 0.7.5-SP1 XSS

In latest Wolf CMS I found XSS vulnerability in 'Forgot password' mechanism.

Go to you admin panel:  and click to 'Forgot password'.

Now put your xss code in forgot_email parameter:

return $this->_sendPasswordTo($_POST['forgot']['email']);


<input class="long" id="forgot-email" type="text" name="forgot[email]" value="<?php echo $email; ?>" />

and that's how we can do an xss attack here.

No comments:

Post a Comment

What do You think...?