lists.openwall.net   lists  /  announce  owl-users  owl-dev  john-users  john-dev  passwdqc-users  yescrypt  popa3d-users  /  oss-security  kernel-hardening  musl  sabotage  tlsify  passwords  /  crypt-dev  xvendor  /  Bugtraq  Full-Disclosure  linux-kernel  linux-netdev  linux-ext4  linux-hardening  linux-cve-announce  PHC 
Open Source and information security mailing list archives
 
Hash Suite: Windows password security audit tool. GUI, reports in PDF.
[<prev] [next>] [<thread-prev] [day] [month] [year] [list]
Message-ID: <CAPhqm0NLPw7fceaUJe39aVxQ5v=6dhOk0_Pc=RzN7OpS_LkYoA@mail.gmail.com>
Date: Wed, 9 Nov 2011 11:04:59 +0100
From: muuratsalo experimental hack lab <muuratsalo@...il.com>
To: bugtraq <bugtraq@...urityfocus.com>
Subject: Re: LabWiki <= 1.1 Multiple Vulnerabilities

Dear all,
there is a small mistake in the Vulnerability overview: it is LabWiki
NOT LabStore!
Best,
muuratsalo

2011/11/9 muuratsalo experimental hack lab <muuratsalo@...il.com>:
> ------------------------------------------------------------------------
> LabWiki <= 1.1 Multiple Vulnerabilities
> ------------------------------------------------------------------------
>
> author............: muuratsalo (Revshell.com)
> contact...........: muuratsalo[at]gmail[dot]com
> download..........: http://www.bioinformatics.org/phplabware/labwiki/index.php
>
>
> [0x01] Vulnerability overview:
>
> All versions of LabStore <= 1.1 are affected by multiple vulnerabilities.
>
>
> [0x02] Disclosure timeline:
>
> [08/11/2011] - Multiple vulnerabilities discovered and reported to the vendor.
> [08/11/2011] - The vendor confirmed the vulnerabilities and he is
> working on fixing the reported issues.
> [09/11/2011] - Public Disclosure
>
>
> [0x03] Vulnerabilities:
>
> -- Shell Upload Vulnerability --
> The upload script /edit.php improperly checks the filetype of uploaded images.
> A 'shell.php.gif' is accepted.  /* -- note that access to edit.php
> could be restricted-- */
>
> -- Multiple Cross Site Scripting Vulnerabilities --
> http://localhost/LabWiki/index.php?from="></><script>alert('muuratsalo')</script>&help=true&page=What_is_wiki
> http://localhost/LabWiki/recentchanges.php?nothing=nothing&page_no="></><script>alert('muuratsalo')</script>
>

Powered by blists - more mailing lists

Powered by Openwall GNU/*/Linux Powered by OpenVZ