|
Neohapsis is currently accepting applications for employment. For more information, please visit our website www.neohapsis.com or email hr@neohapsis.com |
CS-Forum <= 0.81 Cross Site Scripting, SQL Injection, Full Path Disclosure
gmdarkfig
gmail.com
Date: Sun Jun 11 2006 - 12:30:37 CDT
- Messages sorted by: [ date ] [ thread ] [ subject ] [ author ]
Cross Site Scripting
********************
http://[...]/read.php?msg_result=[XSS]
http://[...]/read.php?rep_titre=">[XSS]
Cookies: CSForum_nom=">[XSS]; CSForum_mail=">[XSS]; CSForum_url=">[XSS]
SQL Injection
*************
http://[...]/read.php?id=1'[SQL_SELECT]&debut=[SQL_LIMIT]
http://[...]/index.php?search=%'[SQL_SELECT]%23
http://[...]/index.php?debut=1[SQL] //Digit -> Without quote
Full Path Disclosure
********************
http://[...]/index.php?readall=&collapse[]= //setcookie()
Solution
********
SQL Injection => addslashes() / intval()
Cross Site Scripting => htmlentities()
Full Path Disclosure => is_string()
Credits
*******
by DarkFig -- http://www.acid-root.new.fr/advisories/csforum081.txt
Changelog
*********
[06-06-11] -- Vendor contacted
- Messages sorted by: [ date ] [ thread ] [ subject ] [ author ]