bugtraq - Re: UPublisher Exploit

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Message-ID: <20061204012732.20757.qmail@securityfocus.com>
Date: 4 Dec 2006 01:27:32 -0000
From: me@...rhere.cc
To: bugtraq@...urityfocus.com
Subject: Re: UPublisher Exploit - Superfreaker

In regard to the many articles on Google: 

http://www.google.com/search?hl=en&q=upublisher+exploit  

Superfreaker's "UPublisher" exploit is NOT LIMITED to their "viewarticle.asp" script.

In fact, most of the product is vulnerable to SQL Injection attacks such as "index.asp" and "preferences.asp". 

Two UPublisher scripts that can be hacked using the EXACT SAME METHOD you described above are: 

sendarticle.asp 
printarticle.asp 

If your copy of UPublisher has already been hacked, be CERTAIN to review and clean the uploads folder at:  /images/story_images/

In our case, the hacker was able to upload entire HTML pages ... and then reference them from their browser since they now knew the full URL to their HTML form!

# # # #