XSS vulnerability found via injection in the parameter address


 
Thread Tools Search this Thread
Top Forums Shell Programming and Scripting XSS vulnerability found via injection in the parameter address
# 1  
Old 09-09-2017
XSS vulnerability found via injection in the parameter address

Mods please move if posted in wrong section, I wasnt sure where to ask this one.

There are several of us that use an open source program called yiimp,
Code:
https://github.com/tpruvot/yiimp

several of our sites were attacked last night and I am reaching out to you guys to see if then vulnerability can be fixed quickly.

I believe the offending file is
Code:
/modules/site/wallet.php

my security scan shows
Code:
GET /?address=String.fromCharCode%280%2Cw6w7atn4rh%2C1%29 HTTP/1.1

for the vulnerability
Login or Register to Ask a Question

Previous Thread | Next Thread

3 More Discussions You Might Find Interesting

1. Shell Programming and Scripting

Parameter not found.. pass in a uppercase

hi guys i am trying to convert a uppercase var to a lowercase var and the result is pass in to another var. But i kept getting error from the variable that will be containing the result of the conversion of uppercase to the lowercase. DB_SID=TEST DB_SID_SM=/opt/$DB_SID | tr ''... (5 Replies)
Discussion started by: redologger
5 Replies

2. IP Networking

IP Address not found in ifconfig/netstat

I'm working on an AIX Unix LPAR (AIX 3.5 00C3C9904C00 as returned by uname -a) I can access this box using telnet, port 22 using adress IP A and B A=AA.AA.XX.XX and B=AA.AA.YYY.YYY I can confirm these 2 are the same space, I can see I can't find address B listed anywhere... so I wonder what... (1 Reply)
Discussion started by: Isax50
1 Replies

3. News, Links, Events and Announcements

UUCP Vulnerability found in Linux

NEWS: UUCP vulnerability found in the command line argument handling of uucp which could be exploited by a local user to obtain uucp uid/gid. http://www.linuxhelp.net/article.pl?sid=02/02/20/0335219&mode=&threshold= (1 Reply)
Discussion started by: killerserv
1 Replies
Login or Register to Ask a Question
PIDOF(8)						Linux System Administrator's Manual						  PIDOF(8)

NAME
pidof -- find the process ID of a running program. SYNOPSIS
pidof [-s] [-c] [-n] [-x] [-m] [-o omitpid[,omitpid..]] [-o omitpid[,omitpid..]..] program [program..] DESCRIPTION
Pidof finds the process id's (pids) of the named programs. It prints those id's on the standard output. This program is on some systems used in run-level change scripts, especially when the system has a System-V like rc structure. In that case these scripts are located in /etc/rc?.d, where ? is the runlevel. If the system has a start-stop-daemon (8) program that should be used instead. OPTIONS
-s Single shot - this instructs the program to only return one pid. -c Only return process ids that are running with the same root directory. This option is ignored for non-root users, as they will be unable to check the current root directory of processes they do not own. -n Avoid stat(2) system function call on all binaries which are located on network based file systems like NFS. Instead of using this option the the variable PIDOF_NETFS may be set and exported. -x Scripts too - this causes the program to also return process id's of shells running the named scripts. -o omitpid Tells pidof to omit processes with that process id. The special pid %PPID can be used to name the parent process of the pidof pro- gram, in other words the calling shell or shell script. -m When used with -o, will also omit any processes that have the same argv[0] and argv[1] as any explicitly omitted process ids. This can be used to avoid multiple shell scripts concurrently calling pidof returning each other's pids. EXIT STATUS
0 At least one program was found with the requested name. 1 No program was found with the requested name. NOTES
pidof is actually the same program as killall5; the program behaves according to the name under which it is called. When pidof is invoked with a full pathname to the program it should find the pid of, it is reasonably safe. Otherwise it is possible that it returns pids of running programs that happen to have the same name as the program you're after but are actually other programs. Note that that the executable name of running processes is calculated with readlink(2), so symbolic links to executables will also match. SEE ALSO
shutdown(8), init(8), halt(8), reboot(8), killall5(8) AUTHOR
Miquel van Smoorenburg, miquels@cistron.nl 01 Sep 1998 PIDOF(8)