lists.openwall.net | lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC | |
Open Source and information security mailing list archives
| ||
|
Date: 15 Apr 2006 06:20:20 -0000 From: alex@...ln.com To: bugtraq@...urityfocus.com Subject: [eVuln] aWebBB Multiple XSS and SQL Injection Vulnerabilities New eVuln Advisory: aWebBB Multiple XSS and SQL Injection Vulnerabilities http://evuln.com/vulns/117/summary.html --------------------Summary---------------- eVuln ID: EV0117 CVE: CVE-2006-1637 CVE-2006-1638 Software: aWebBB Sowtware's Web Site: http://labs.aweb.com.au/ Versions: 1.2 Critical Level: Moderate Type: Multiple Vulnerabilities Class: Remote Status: Unpatched. Developer(s) contacted. PoC/Exploit: Available Solution: Not Available Discovered by: Aliaksandr Hartsuyeu (eVuln.com) -----------------Description--------------- 1. Multiple Cross-Site Scripting Vulnerabilities. Vulnerable Scripts: post.php register.php editac.php Parameters tname(post.php), fpost(post.php), fullname(editac.php), emailadd(editac.php), country(editac.php), sig(editac.php), otherav(editac.php), fullname(register.php), emailadd(register.php), country(register.php) are not properly sanitized. All BBCodes are not properly sanitized too. This can be used to post arbitrary HTML or web script code. 2. Multiple SQL Injections. Vulnerable scripts: accounts.php changep.php dpost.php ($_GET[p]) editac.php feedback.php fpass.php list.php ($_GET[c]) login.php ndis.php id,c post.php reply.php reply_log.php search.php q Parameters $Username(accounts.php, changep.php, editac.php, feedback.php, fpass.php, login.php, post.php, reply.php, reply_log.php), p(dpost.php), c(list.php,ndis.php), q(search.php) are not properly sanitized before being used in SQL queries. This can be used to make any SQL query by injecting arbitrary SQL code. Condition: magic_quotes_gpc = off --------------PoC/Exploit---------------------- Available at: http://evuln.com/vulns/117/exploit.html --------------Solution--------------------- No Patch available. --------------Credit----------------------- Discovered by: Aliaksandr Hartsuyeu (eVuln.com) Regards, Aliaksandr Hartsuyeu http://evuln.com - Penetration Testing Services .
Powered by blists - more mailing lists