poc2
Critical Unrestricted File Upload vulnerability found @ Web-Based Teaching System (Myanmar) URL : http://www.wbts.com.mm

Malicious Attacker can upload some file to server without permission ! And It has persistent XSS vulnerability.

Cross Site Scripting is a client-side attack where an attacker can craft a malicious link, containing script- code which is then executed within the victim’s browser when the target site vulnerable to and injected with XSS is viewed. The script-code can be any language supported by the browser but mostly HTML and Javascript is used along with embedded Flash, Java or ActiveX.

poc3

In some cases where the XSS vulnerability is persistent as described further below, the attacker will not have to craft a link as the injected script is inserted directly into the target site and / or web application. The target user(s) still has to view the affected site / page where the injected code is located though.

The persistent XSS can be triggered just by browsing a Web Application with code injected into it. (This depends on which page has code injected, in case the target is not globally affected on all pages loaded by the user.)

Details

=======

Used Product :  ColdFusion 9

Vulnerability Type : Unrestricted File Upload & Persistent XSS

Security Risk : Critical

Effected URL : http://www.wbts.com.mm/dcs/act_reg.cfm

CVE : CVE-2005-0254

CVE URL : http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE2005-0254

Informed to :- Webmaster

This is vulnerability is posted at Vulnerabilities Research Page : http://www.planetcreator.net/category/hacking/

We hope that your security staff will look into this issue and fix it as soon as possible.

Explore More

EU Police learning hacking tricks. They are about to “Remote search” your PCs.

Law enforcement at European Union is working on ethical hacking proposal that will allow them to remotely access and monitor any PC without warrant. This is adopted after a decision

Read More

#RefRef – Denial of Service ( DDoS ) Tool Developed by Anonymous

Anonymous is developing a new DDoS tool which is said to exploit SQL vulnerabilities to support the group’s future campaigns. So far, what they have is something that is platform

Read More

What are snort rules?

Snort rules are the conditions specified by a Network Administrator that differentiate between normal Internet activities and malicious activities. Snort rules are made up of two basic parts: * Rule

Read More