Sponsored Content
Top Forums Shell Programming and Scripting XSS vulnerability found via injection in the parameter address Post 303003219 by crombiecrunch on Saturday 9th of September 2017 04:13:33 PM
Old 09-09-2017
XSS vulnerability found via injection in the parameter address

Mods please move if posted in wrong section, I wasnt sure where to ask this one.

There are several of us that use an open source program called yiimp,
Code:
https://github.com/tpruvot/yiimp

several of our sites were attacked last night and I am reaching out to you guys to see if then vulnerability can be fixed quickly.

I believe the offending file is
Code:
/modules/site/wallet.php

my security scan shows
Code:
GET /?address=String.fromCharCode%280%2Cw6w7atn4rh%2C1%29 HTTP/1.1

for the vulnerability
 

3 More Discussions You Might Find Interesting

1. News, Links, Events and Announcements

UUCP Vulnerability found in Linux

NEWS: UUCP vulnerability found in the command line argument handling of uucp which could be exploited by a local user to obtain uucp uid/gid. http://www.linuxhelp.net/article.pl?sid=02/02/20/0335219&mode=&threshold= (1 Reply)
Discussion started by: killerserv
1 Replies

2. IP Networking

IP Address not found in ifconfig/netstat

I'm working on an AIX Unix LPAR (AIX 3.5 00C3C9904C00 as returned by uname -a) I can access this box using telnet, port 22 using adress IP A and B A=AA.AA.XX.XX and B=AA.AA.YYY.YYY I can confirm these 2 are the same space, I can see I can't find address B listed anywhere... so I wonder what... (1 Reply)
Discussion started by: Isax50
1 Replies

3. Shell Programming and Scripting

Parameter not found.. pass in a uppercase

hi guys i am trying to convert a uppercase var to a lowercase var and the result is pass in to another var. But i kept getting error from the variable that will be containing the result of the conversion of uppercase to the lowercase. DB_SID=TEST DB_SID_SM=/opt/$DB_SID | tr ''... (5 Replies)
Discussion started by: redologger
5 Replies
IRSEND(1)								FSF								 IRSEND(1)

NAME
irsend - basic LIRC program to send infra-red commands SYNOPSIS
irsend [options] DIRECTIVE REMOTE CODE [CODE...] DESCRIPTION
Asks the lircd daemon to send one or more CIR (Consumer Infra-Red) commands. This is intended for remote control of electronic devices such as TV boxes, HiFi sets, etc. DIRECTIVE can be: SEND_ONCE - send CODE [CODE ...] once SEND_START - start repeating CODE SEND_STOP - stop repeating CODE LIST - list configured remote items SET_TRANSMITTERS - set transmitters NUM [NUM ...] SIMULATE - simulate IR event REMOTE is the name of a remote, as described in the lircd configuration file. CODE is the name of a remote control key of REMOTE, as it appears in the lircd configuration file. NUM is the transmitter number of the hardware device. For the LIST DIRECTIVE, REMOTE and/or CODE can be empty: LIST "" "" - list all configured remote names LIST REMOTE "" - list all codes of REMOTE LIST REMOTE CODE - list only CODE of REMOTE The SIMULATE command only works if it has been explicitly enabled in lircd. -h --help display usage summary -v --version display version -d --device use given lircd socket [/var/run/lirc/lircd] -a --address=host[:port] connect to lircd at this address -# --count=n send command n times EXAMPLES
irsend LIST DenonTuner "" irsend SEND_ONCE DenonTuner PROG-SCAN irsend SEND_ONCE OnkyoAmpli VOL-UP VOL-UP VOL-UP VOL-UP irsend SEND_START OnkyoAmpli VOL-DOWN ; sleep 3 irsend SEND_STOP OnkyoAmpli VOL-DOWN irsend SET_TRANSMITTERS 1 irsend SET_TRANSMITTERS 1 3 4 irsend SIMULATE "0000000000000476 00 OK TECHNISAT_ST3004S" FILES
/etc/lirc/lircd.conf Default lircd configuration file. It should contain all the remotes, their infra-red codes and the corresponding timing and wave- form details. DIAGNOSTICS
If lircd is not running (or /var/run/lirc/lircd lacks write permissions) irsend aborts with the following diagnostics: "irsend: could not connect to socket" "irsend: Connection refused" (or "Permission denied"). SEE ALSO
The documentation for lirc is maintained as html pages. They are located under html/ in the documentation directory. lircd(8), mode2(1), smode2(1), xmode2(1), irrecord(1), irw(1), http://www.lirc.org. irsend 0.8.7pre1 May 2010 IRSEND(1)
All times are GMT -4. The time now is 09:05 AM.
Unix & Linux Forums Content Copyright 1993-2022. All Rights Reserved.
Privacy Policy