Charles River Admin Panel Reflected Cross Site Scripting
About Charles River:
Charles River provides an executable for high profile people which helps them to make decision about investment. It has some automated algorithm which performs the calculation and analysis and help the user to take investment decision.
This executable has an admin panel which is accessible through web browser.
Vulnerability:
The admin website of Charles River is vulnerable to post authentication cross site scripting vulnerability.
The file configPopup.do has parameter "n" which is vulnerable to reflected cross site scripting.
Exploit URL:
domain.com:8081/crts/admin/failover/configPopup.do?n=beanEventPublisher%3cscript%3ealert(1)%3c%2fscript%3e
Solution:
Not yet rolled out
Disclosure Timeline:
August 2018: Informed to Charles River - No reply
December 2018:Reminder mail sent through Contact Us - No reply
January 1 2019: Full disclosure.
Charles River provides an executable for high profile people which helps them to make decision about investment. It has some automated algorithm which performs the calculation and analysis and help the user to take investment decision.
This executable has an admin panel which is accessible through web browser.
Vulnerability:
The admin website of Charles River is vulnerable to post authentication cross site scripting vulnerability.
The file configPopup.do has parameter "n" which is vulnerable to reflected cross site scripting.
Exploit URL:
domain.com:8081/crts/admin/failover/configPopup.do?n=beanEventPublisher%3cscript%3ealert(1)%3c%2fscript%3e
Solution:
Not yet rolled out
Disclosure Timeline:
August 2018: Informed to Charles River - No reply
December 2018:Reminder mail sent through Contact Us - No reply
January 1 2019: Full disclosure.
Hello Everone
ReplyDeleteFullz available in bulk quantity
Fresh spammed & verified info
SSN DOB DL ADDRESS
SIN DOB ADDRESS MMN
NIN DOB ADDRESS SORT CODE
USA UK CANADA All states info fullz available
Good Credit Scores & High quality info
All info will be valid & Genuine spammed not generated
Contact me here
What's App = +1... 727... 788.. 6129..
Tele Gram = @ killhacks - @ leadsupplier
Email = bigbull0334 at g mail dot com
Skype = @ peeterhacks
USA All info available with guarantee
DL Photos Front Back with SSN
High Credit Scores Pros
DL Fullz with issue & exp dates
UK & Canada DL Front back with selfie
Passport Photos
SSN DOB DL Fullz
SIN DOB ADDRESS MMN Fullz
NIN DOB DL ADDRESS SORT CODE ACCOUNT NUMBER Fullz
Young & Old Age Fullz
CC with CVV
Dumps with Pin codes
All stuff will be fresh & valid
Feel free to contact me
#fullz #ssnfullz #ssndlfullz #usafullz #ccfullzcvv
#ukfullz #ukdobaddress #ninukdl #ninDL #uknindobdl #ninsortcode
#sinfullz #canadafullz #sinnindob #prosCC #ccdumps #sellfullzpros
Hello Guy's
ReplyDeleteFullz available fresh USA UK CANADA
Updatd-2025 Database with guarantee
Fresh Stuff never sold before
Bulk quantity available
SSN NIN SIN Fullz with all info
DL Scans Fresh Front & Back with Selfie
Contact us here for more info & deals:
Tele Gram - @ killhacks , @ leadsupplier
What's App - + (1)..727.. 788..6129
TG Channel - t.me/ leadsproviderworldwide
*Be aware from scammers using our cloned names
(Make sure to visit our channel for real usernames & latest updated stuff)
Fullz|Pros|Leads List:
SSN DOB DL Address Fullz USA
NIN DOB DL Address Sort code & Account number Fullz UK
SIN DOB Address MMN Email Phone Fullz Canada
DL Scans front back with SSN USA
DL Scans real Front back with Selfie USA|UK|CA
Passport Photos with Selfie USA|UK|CA
Business EIN Company Pros USA
High Credit Scores Fullz USA|UK|CA
Dead Fullz in bulk quantity
CC Fullz with CVV & billing Address
Dumps with Pin Track 101 & 202 with Cash out Tutorials
Children Fullz 2011-2023
Old & young Age Fullz 1935-2009
Sweep Stakes Fresh & Casino Leads
Bulk Email (business|Crypto|B2B|Medical|Payday) Leads
W-2 Forms with DL
Medical & Hospital Database Leads
Uber Eats & Doordash KYC Stuff
Tax Return Filling Fullz
Fullz for SBA|PUA|UI|FASFA|Loans
RDP|SMTP|SHELLS
C-Panels|Web-Mailers
Bulk SMS & Email Senders
Scam Pages & Scripting
Carding, Cash out, Loan Methods
#SSN #SSNDOBDL #SellSSN #CCShop #CCSELLCVV #ShopSSNDOBDLADDRESS #FULLZ #SSNFULLZ
#REALDLSCAN #YoungAgeFullz #Fullzseller #USAFULLZ #FULLZUSA #SellerSSNDOB #ShopSSNDOB
#BusinessFullzUSA #USAPros #USALeads #EINFullz #SIN #SINDOBDL #SellSIN #SINMMNFULLZ #MMNPROSSIN #MMNSIN
#NIN #NINDOBDL #SellNIN #CCShop #CCSELLCVV #ShopNINDOBDLADDRESS #FULLZ #NINFULLZ
Many more stuff available for you guy's
Try our stuff & make good money
Fresh stuff guaranteed
Payment mode only in crypto
Contact us fast for fresh Stuff