bugtraq - IwebNegar v1.1 Multiple vulnerabilities

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Message-ID: <20060830060322.26969.qmail@securityfocus.com>
Date: 30 Aug 2006 06:03:22 -0000
From: Hessamx@...samx.net
To: bugtraq@...urityfocus.com
Subject: IwebNegar v1.1 Multiple vulnerabilities

::  IwebNegar v1.1 Multiple vulnerabilities  ::
------------------------------------------------
Software     : IwebNegar v1.1
Website      : ----
Bug Discover : Hessam-x / www.hessamx.net

I. Cross Site Scripting Vulnerability
-------------------------------------------------
Parameter "comment" are not properly sanitized in "comments.php".
This can be used to post arbitrary HTML or web script code. 
 attacked by comments.php with field comment
& ...

II. SQL Injection Vulnerability
-------------------------------------------------
Parameter "id" is not properly sanitized before being used in SQL query.
vulnerable Page is : "comments.php".
This can be used make any SQL query by injecting arbitrary SQL code.
Attacker can be execute this url :
comments.php?id=[SQL Query]