Site exploitable to XSS (adobe cold fusion)

Cake · 03-26-2014, 03:36 PM

So some kid linked me his schools DB for all of the students etc. They use Adobe Coldfusion, but they also use a version of it that was found to have XSS written all over it.
enjoy,
http://www.mvaims.org/CFIDE/administrator/enter.cfm

BreShiE · 03-26-2014, 04:09 PM

I'd highly recommend taking a look at this thread.

https://www.sinister.ly/Thread-Tutorial-...igh-Detail

Bannedshee · 03-26-2014, 04:31 PM

I thought the CF exploit was LFI o.O

BreShiE · 03-26-2014, 05:16 PM

(03-26-2014, 04:31 PM)Bannedshee Wrote: I thought the CF exploit was LFI o.O

Well technically it's a mixture of the two. But I posted this to show the OP that there's more to do than XSS.

Cake · 03-26-2014, 05:22 PM

(03-26-2014, 05:16 PM)BreShiE Wrote: Well technically it's a mixture of the two. But I posted this to show the OP that there's more to do than XSS.

I read that thread but this part "value will be displayed on the password." made absolutely no sense.

BreShiE · 03-26-2014, 05:25 PM

(03-26-2014, 05:22 PM)Kodo Wrote: I read that thread but this part "value will be displayed on the password." made absolutely no sense.

Well try it out and see for yourself. Derp.

Cake · 03-26-2014, 05:43 PM

(03-26-2014, 05:25 PM)BreShiE Wrote: Well try it out and see for yourself. Derp.

There's no value located anywhere m8.

Site may not be vulnerable >.>
But when I checked like idk 2 months ago it was.