From full-disclosure Fri May 08 13:19:46 2015 From: Jing Wang Date: Fri, 08 May 2015 13:19:46 +0000 To: full-disclosure Subject: [FD] MT.VERNON MEDIA Web-Design v1.12 Multiple XSS (Cross-site Scripting) Web Security Vulnerabiliti Message-Id: X-MARC-Message: https://marc.info/?l=full-disclosure&m=143110900012641 Kk1ULlZFUk5PTiBNRURJQSBXZWItRGVzaWduIHYxLjEyIE11bHRpcGxlIFhTUyAoQ3Jvc3Mtc2l0 ZSBTY3JpcHRpbmcpIFdlYgpTZWN1cml0eSBWdWxuZXJhYmlsaXRpZXMqCgoKRXhwbG9pdCBUaXRs ZTogTVQuVkVSTk9OIE1FRElBIFdlYi1EZXNpZ24gdjEuMTIgTXVsdGlwbGUgWFNTIFNlY3VyaXR5 ClZ1bG5lcmFiaWxpdGllcwpQcm9kdWN0OiBXZWItRGVzaWduClZlbmRvcjogTVQuVkVSTk9OIE1F RElBClZ1bG5lcmFibGUgVmVyc2lvbnM6IHYxLjEyClRlc3RlZCBWZXJzaW9uOiB2MS4xMgpBZHZp c29yeSBQdWJsaWNhdGlvbjogTWF5IDA3LCAyMDE1CkxhdGVzdCBVcGRhdGU6IE1heSAwNywgMjAx NQpWdWxuZXJhYmlsaXR5IFR5cGU6IENyb3NzLVNpdGUgU2NyaXB0aW5nIFtDV0UtNzldCkNWRSBS ZWZlcmVuY2U6ICoKSW1wYWN0IENWU1MgU2V2ZXJpdHkgKHZlcnNpb24gMi4wKToKQ1ZTUyB2MiBC YXNlIFNjb3JlOiA0LjMgKE1FRElVTSkgKEFWOk4vQUM6TS9BdTpOL0M6Ti9JOlAvQTpOKSAobGVn ZW5kKQpJbXBhY3QgU3Vic2NvcmU6IDIuOQpFeHBsb2l0YWJpbGl0eSBTdWJzY29yZTogOC42Cldy aXRlciBhbmQgUmVwb3J0ZXI6IFdhbmcgSmluZyBbTWF0aGVtYXRpY3MsIE5hbnlhbmcgVGVjaG5v bG9naWNhbApVbml2ZXJzaXR5IChOVFUpLCBTaW5nYXBvcmVdIChAanVzdHFkamluZykKCgoKCipS ZWNvbW1lbmRhdGlvbiBEZXRhaWxzOioKCgoqKDEpIFZlbmRvciAmIFByb2R1Y3QgRGVzY3JpcHRp b246KgoKCipWZW5kb3I6KgpNVC5WRVJOT04gTUVESUEKCgoKKlByb2R1Y3QgJiBWdWxuZXJhYmxl IFZlcnNpb25zOioKV2ViLURlc2lnbgp2MS4xMgoKCgoqVmVuZG9yIFVSTCAmIERvd25sb2FkOioK TVQuVkVSTk9OIE1FRElBIGNhbiBiZSBvYnRhaW5lZCBmcm9tIGhlcmUsCmh0dHA6Ly93d3cubXR2 ZXJub25tZWRpYS5jb20vc2VydmljZXMvV2ViRGVzaWduLmh0bWwKCgoKKkdvb2dsZSBEb3JrOioK ImRldmVsb3BlZCBieTogTXQuIFZlcm5vbiBNZWRpYSIKCgoKKlByb2R1Y3QgSW50cm9kdWN0aW9u IE92ZXJ2aWV3OioKIkluIHRvZGF5J3MgZWNvbm9teSBldmVyeSBidXNpbmVzcyBpcyBtb3JlIGZv Y3VzZWQgb24gUk9JIChSZXR1cm4gT24KSW52ZXN0bWVudCkgdGhhbiBldmVyIGJlZm9yZS4gV2Un bGwgaGVscCB5b3UgZW5zdXJlIGEgc29saWQgUk9JIGZvciB5b3VyCndlYnNpdGUsIG5vdCBvbmx5 IG1ha2luZyBpdCBlZmZlY3RpdmUgYW5kIGVhc3kgdG8gdXNlIGZvciB5b3VyIGNsaWVudHMsIGJ1 dApoZWxwaW5nIHlvdSB0byBkcml2ZSB0cmFmZmljIHRvIHlvdXIgc2l0ZSBhbmQgZW5zdXJpbmcg ZWZmZWN0aXZlIGNvbnRlbnQKYW5kIGRlc2lnbiB0byB0dXJuIHRyYWZmaWMgaW50byBzb2xpZCBs ZWFkcywgc2FsZXMsIG9yIHJlcGVhdCBjdXN0b21lcnMuIFdlCm9mZmVyIGN1c3RvbSBkZXNpZ24g YW5kIGRldmVsb3BtZW50IHNlcnZpY2VzIHRhaWxvcmVkIHRvIHlvdXIgbmVlZHMgYW5kCnNwZWNp ZmljYXRpb25zIGRyYXduIHVwIGpvaW50bHkgd2l0aCB5b3UgdG8gZW5zdXJlIHRoYXQgdGhlIGFw cHJvcHJpYXRlCnRlY2hub2xvZ3kgaXMgbGV2ZXJhZ2VkIGZvciBvcHRpbXVtIHJlc3VsdHMsIGNy ZWF0aW5nIGEgZHluYW1pYyBhbmQKZWZmZWN0aXZlIGRlc2lnbiwgYmFzZWQgb24gbWFya2V0IGVm ZmVjdGl2ZW5lc3MgYW5kIHVzZXItZnJpZW5kbHkgZGVzaWduCnN0YW5kYXJkcy4gT3VyIGRldmVs b3BlcnMgYXJlIGV4cGVydHMgaW4gd2ViIGFwcGxpY2F0aW9uIGRldmVsb3BtZW50IHVzaW5nCnZh cmlvdXMgcHJvZ3JhbW1pbmcgbGFuZ3VhZ2VzIGluY2x1ZGluZyBQZXJsLCBTUUwsIEMsIEMrLCBh bmQgbWFueSBvdGhlcgpiYWNrLWVuZCBwcm9ncmFtbWluZyBsYW5ndWFnZXMsIGFzIHdlbGwgYXMg ZGF0YWJhc2UgaW50ZWdyYXRpb24uIEZvciBhIHZpZXcKb2Ygc29tZSBvZiB5b3VyIHBhc3QgcHJv amVjdHMsIHRha2UgYSBsb29rIGF0IG91ciBsaXN0IG9mIGNsaWVudHMuIFdlCmhhbmRsZSBjdXN0 b20gZGV2ZWxvcG1lbnQgb2YgeW91ciBJbnRlcm5ldCBwcm9qZWN0IGZyb20gY29uY2VwdGlvbiB0 aHJvdWdoCnB1YmxpY2F0aW9uOgoKICAgIEludGVybmV0ICYgSW50cmFuZXQgc2l0ZXMKICAgIERl c2lnbiBjb25jZXB0cywgbGF5b3V0cywgYW5kIHNwZWNpZmljYXRpb25zCiAgICBJbnR1aXRpdmUg R3JhcGhpY2FsIFVzZXIgSW50ZXJmYWNlIChHVUkpIGRlc2lnbgogICAgRHluYW1pYyBuYXZpZ2F0 aW9uIGRlc2lnbgogICAgQ3JlYXRpb24gYW5kIG1hbmlwdWxhdGlvbiBvZiBncmFwaGljYWwgZGVz aWduIGVsZW1lbnRzCiAgICBHSUYgQW5pbWF0aW9uCiAgICBGbGFzaCBkZXZlbG9wbWVudAogICAg SFRNTCBoYW5kLWNvZGluZyBhbmQgZGVidWdnaW5nCiAgICBKYXZhU2NyaXB0IGZvciBpbnRlcmFj dGl2aXR5IGFuZCBlcnJvci1jaGVja2luZwogICAgQVNQIChBY3RpdmUgU2VydmVyIFBhZ2VzKQog ICAgQ3VzdG9taXplZCBQZXJsIENHSSBzY3JpcHRzIChtYWlsaW5nIGxpc3RzLCBmb3JtIHN1Ym1p c3Npb24sIGV0YykKICAgIEN1c3RvbWl6ZWQgYXBwbGljYXRpb24gZGV2ZWxvcG1lbnQgaW4gdmFy aWVkIHByb2dyYW1taW5nIGxhbmd1YWdlcwogICAgU2l0ZSBwdWJsaWNhdGlvbiBhbmQgcHJvbW90 aW9uCiAgICBPbi1nb2luZyB1cGRhdGluZyBhbmQgbWFpbnRlbmFuY2UKICAgIEJhbm5lciBhZHMi CgoKCgoqKDIpIFZ1bG5lcmFiaWxpdHkgRGV0YWlsczoqCk1ULlZFUk5PTiBNRURJQSBXZWItRGVz aWduIHdlYiBhcHBsaWNhdGlvbiBoYXMgYSBjb21wdXRlciBzZWN1cml0eSBidWcKcHJvYmxlbS4g SXQgY2FuIGJlIGV4cGxvaXRlZCBieSBzdG9yZWQgWFNTIGF0dGFja3MuIFRoaXMgbWF5IGFsbG93 IGEgcmVtb3RlCmF0dGFja2VyIHRvIGNyZWF0ZSBhIHNwZWNpYWxseSBjcmFmdGVkIHJlcXVlc3Qg dGhhdCB3b3VsZCBleGVjdXRlIGFyYml0cmFyeQpzY3JpcHQgY29kZSBpbiBhIHVzZXIncyBicm93 c2VyIHNlc3Npb24gd2l0aGluIHRoZSB0cnVzdCByZWxhdGlvbnNoaXAKYmV0d2VlbiB0aGVpciBi cm93c2VyIGFuZCB0aGUgc2VydmVyLgoKU2V2ZXJhbCBvdGhlciBNVC5WRVJOT04gTUVESUEgcHJv ZHVjdHMgMC1kYXkgdnVsbmVyYWJpbGl0aWVzIGhhdmUgYmVlbgpmb3VuZCBieSBzb21lIG90aGVy IGJ1ZyBodW50ZXIgcmVzZWFyY2hlcnMgYmVmb3JlLiBNVC5WRVJOT04gTUVESUEgaGFzCnBhdGNo ZWQgc29tZSBvZiB0aGVtLiBCdWdTY2FuIGlzIHRoZSBmaXJzdCBjb21tdW5pdHktYmFzZWQgc2Nh bm5lciwKZXhwZXJpZW5jZWQgZml2ZSBjb2RlIHJlZmFjdG9yaW5nLiBJdCBoYXMgcmVkZWZpbmVk IHRoZSBjb25jZXB0IG9mIHRoZQpzY2FubmVyIHByb3ZpZGVzIHNvdXJjZXMgZm9yIHRoZSBsYXRl c3QgaW5mby1zZWMgbmV3cywgdG9vbHMsIGFuZAphZHZpc29yaWVzLiBJdCBhbHNvIHB1Ymxpc2hz IHN1Z2dlc3Rpb25zLCBhZHZpc29yaWVzLCBzb2x1dGlvbnMgZGV0YWlscwpyZWxhdGVkIHRvIFhT UyB2dWxuZXJhYmlsaXRpZXMuCgoKKigyLjEpICpUaGUgZmlyc3QgcHJvZ3JhbW1pbmcgY29kZSBm bGF3IG9jY3VycyBhdCAic2VjdGlvbi5waHA/IiBwYWdlIHdpdGgKIiZpZCIgcGFyYW1ldGVyLgoK KigyLjIpKiBUaGUgc2Vjb25kIHByb2dyYW1taW5nIGNvZGUgZmxhdyBvY2N1cnMgYXQgImlsbHVz dHJhdGVkX3ZlcnNlLnBocD8iCnBhZ2Ugd2l0aCAiJmlkIiBwYXJhbWV0ZXIuCgoqKDIuMykqIFRo ZSB0aGlyZCBwcm9ncmFtbWluZyBjb2RlIGZsYXcgb2NjdXJzIGF0ICJpbWFnZS5waHA/IiBwYWdl IHdpdGgKIiZpZCIgcGFyYW1ldGVyLgoKKigyLjQpICpUaGUgZm9ydGggcHJvZ3JhbW1pbmcgY29k ZSBmbGF3IG9jY3VycyBhdCAiZ2FsbGVyeS5waHA/IiBwYWdlIHdpdGgKIiZucCIgcGFyYW1ldGVy LgoKCgoKCgoKKlJlZmVyZW5jZXM6KgpodHRwOi8vd3d3LnRldHJhcGguY29tL3NlY3VyaXR5L3hz cy12dWxuZXJhYmlsaXR5L210LXZlcm5vbi1tZWRpYS13ZWItZGVzaWduLXYxLTEyLW11bHRpcGxl LXhzcy8KaHR0cDovL3NlY3VyaXR5cmVsYXRlZC5ibG9nc3BvdC5jb20vMjAxNS8wNS9tdHZlcm5v bi1tZWRpYS13ZWItZGVzaWduLXYxMTItbXVsdGlwbGUuaHRtbApodHRwOi8vd3d3LmluemVlZC5j b20va2FsZWlkb3Njb3BlL2NvbXB1dGVyLXdlYi1zZWN1cml0eS9tdC12ZXJub24tbWVkaWEtd2Vi LWRlc2lnbi12MS0xMi1tdWx0aXBsZS14c3MvCmh0dHBzOi8vdnVsbmVyYWJpbGl0eXBvc3Qud29y ZHByZXNzLmNvbS8yMDE1LzA1LzA4L210LXZlcm5vbi1tZWRpYS13ZWItZGVzaWduLXYxLTEyLW11 bHRpcGxlLXhzcy8KaHR0cDovL3doaXRlaGF0cG9zdC5ibG9nLjE2My5jb20vYmxvZy9zdGF0aWMv MjQyMjMyMDU0MjAxNTQ4ODUwMzY0NjkKaHR0cHM6Ly9wcm9ncmVzc2l2ZS1jb21wLmNvbS8/YT0x MzkyMjIxNzYzMDAwMTQmcj0xJnc9MeKAiwpodHRwczovL3d3dy5mdXNpb252bS5jb20vRnVzaW9u Vk0vRGVza3RvcE1vZHVsZXMvU2VjdXJpdHlBZHZpc29yaWVzL1NlY3VyaXR5QWR2aXNvcmllc1Zp ZXcuYXNweD9BbGlhcz13d3cuZnVzaW9udm0mVGFiSWQ9MCZMYW5nPWVuLVVTJk9VPTAmSXRlbUlk PTQ0ODMyCmh0dHBzOi8vd3d3LmJ1Z3NjYW4ubmV0LyMhL3gvMjEyODkKaHR0cDovL2JsdWVyZWFk ZXIub3JnL2FydGljbGUvMzA3NjU1OTYKCgoKCgoKLS0KSmluZyBXYW5nLApEaXZpc2lvbiBvZiBN YXRoZW1hdGljYWwgU2NpZW5jZXMgKE1BUyksClNjaG9vbCBvZiBQaHlzaWNhbCBhbmQgTWF0aGVt YXRpY2FsIFNjaWVuY2VzIChTUE1TKSwKTmFueWFuZyBUZWNobm9sb2dpY2FsIFVuaXZlcnNpdHkg KE5UVSksClNpbmdhcG9yZS4KaHR0cDovL3d3dy50ZXRyYXBoLmNvbS93YW5namluZy8KaHR0cHM6 Ly90d2l0dGVyLmNvbS9qdXN0cWRqaW5nCgpfX19fX19fX19fX19fX19fX19fX19fX19fX19fX19f X19fX19fX19fX19fX19fXwpTZW50IHRocm91Z2ggdGhlIEZ1bGwgRGlzY2xvc3VyZSBtYWlsaW5n IGxpc3QKaHR0cHM6Ly9ubWFwLm9yZy9tYWlsbWFuL2xpc3RpbmZvL2Z1bGxkaXNjbG9zdXJlCldl YiBBcmNoaXZlcyAmIFJTUzogaHR0cDovL3NlY2xpc3RzLm9yZy9mdWxsZGlzY2xvc3VyZS8=