=================================================================================== Online Subtitles Workshop XSS vulnerabilities =================================================================================== # Exploit Title: Online Subtitles Workshop XSS vulnerabilities # Author: M.Jock3R (www.the-code.tk) # Script Download: http://sourceforge.net/projects/onlinesubtitles/files/ # Category:: webapps # Tested on: windows XP Sp2 FR =================================================================================== Vuln file: video_comments.php Vuln code: --------- $all_comments = read_video_comments($video_id); //print_r($all_comments); $video_comments = ""; for ($i = 0; $i <= count($all_comments)-1; $i++) { $video_comments = $video_comments . "
".get_user_name($all_comments[$i]['id'])." | ".date('h:i:s A m-d-Y ', $all_comments[$i]['time'])." | |||||
".$all_comments[$i]['message']." <== Here you can inject any HTML or Javascript code :) |