| lists.openwall.net | lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC | |
|
Open Source and information security mailing list archives
| ||
|
Message-ID: <20060315181302.23340.qmail@securityfocus.com> Date: 15 Mar 2006 18:13:02 -0000 From: alex@...ln.com To: bugtraq@...urityfocus.com Subject: [eVuln] discussion - xhawk.net BBCode 'img' XSS & SQL Injection Vulnerabilities New eVuln Advisory: discussion - xhawk.net BBCode 'img' XSS & SQL Injection Vulnerabilities http://evuln.com/vulns/92/summary.html --------------------Summary---------------- eVuln ID: EV0092 Vendor: xhawk.net Vendor's Web Site: http://xhawk.net Software: discussion Sowtware's Web Site: http://xhawk.net/projects/discussion/ Versions: 2.0 beta2 Critical Level: Moderate Type: Multiple Vulnerabilities Class: Remote Status: Unpatched. No reply from developer(s) PoC/Exploit: Available Solution: Not Available Discovered by: Aliaksandr Hartsuyeu (eVuln.com) -----------------Description--------------- 1. 'img' BBCode Cross-Site Scripting Vulnerability BBCode tag [img] isn't properly sanitized. This can be used to insert arbitrary JavaScript code. This code will be executed by visitor's browser in context of the affected site. 2. SQL Injection Vulnerability. Vulnerable script: discussion.class..php Variable $view isn't properly sanitized before being used in the SQL query. This can be used to make any SQL query by injecting arbitrary SQL code. --------------PoC/Exploit---------------------- Available at: http://evuln.com/vulns/92/exploit.html --------------Solution--------------------- No Patch available. --------------Credit----------------------- Discovered by: Aliaksandr Hartsuyeu (eVuln.com) Regards, Aliaksandr Hartsuyeu http://evuln.com - Penetration Testing Services .
Powered by blists - more mailing lists