bugtraq - CS-Forum <= 0.81 Cross Site Scripting, SQL Injection, Full Path Disclosure

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Date: 11 Jun 2006 17:30:37 -0000
From: gmdarkfig@...il.com
To: bugtraq@...urityfocus.com
Subject: CS-Forum <= 0.81 Cross Site Scripting, SQL Injection, Full Path
 Disclosure


Cross Site Scripting
********************
http://[...]/read.php?msg_result=[XSS]
http://[...]/read.php?rep_titre=">[XSS]
Cookies: CSForum_nom=">[XSS]; CSForum_mail=">[XSS]; CSForum_url=">[XSS]

SQL Injection
*************
http://[...]/read.php?id=1'[SQL_SELECT]&debut=[SQL_LIMIT]
http://[...]/index.php?search=%'[SQL_SELECT]%23
http://[...]/index.php?debut=1[SQL] //Digit -> Without quote

Full Path Disclosure 
********************
http://[...]/index.php?readall=&collapse[]= //setcookie()


Solution
********
SQL Injection => addslashes() / intval()
Cross Site Scripting => htmlentities()
Full Path Disclosure => is_string()


Credits
*******
by DarkFig -- http://www.acid-root.new.fr/advisories/csforum081.txt


Changelog
*********
[06-06-11] -- Vendor contacted