[Full-disclosure] ACG-PTP 1.0.6 index.php persistent XSS

From: bug squash <bugsquashr_at_replaced.for.your.security>
Date: Fri, 22 Aug 2008 11:23:20 -0400

###################################
ACG-PTP 1.0.6 index.php persistent XSS
###################################

Author: FatBack Mac and the BBQ gang
Link: http://www.discountedscripts.com/demos/acg-ptp/admin/index.php

Multiple persistent XSS in the admin panel -

Example:
Advertisment Packages
POST to "Category name" field

Credit/Debit Users:
POST to "Reason" Field

Add new FAQ entry:
POST to "FAQ question" and "FAQ answer"

etc....

GREETZ:
Tyler Trioxide, d00m3d! Chik3n hUnT3r 666, T4c0 b3LL cRu

############################################
PRAISE HEPHAESTUS *** PRAISE HEPHAESTUS
############################################

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/
Received on Fri Aug 22 2008 - 11:23:20 EDT