Monday, April 17, 2006

Linpha - XSS Vulnerabilities


Linpha - XSS Vulnerabilities
--------------------------------------------------------
Software: Linpha
Version: 1.1.0
Type: Cross Site Scripting Vulnerability
Date: Mon Apr 17 22:59:39 CEST 2006
Vendor: The LinPHA developers
Page: http://linpha.sourceforge.net/
Risc: Low

credits:
----------------------------
d4igoro - d4igoro[at]gmail[dot]com
http://d4igoro.blogspot.com/
Greetz: karambole

vulnerability:
----------------------------
http://[target]/plugins/stats/stats_view.php?date_from=[XSS]
http://[target]/plugins/stats/stats_view.php?date_to=[XSS]
http://[target]/plugins/stats/stats_view.php?date=[XSS]

notes:
----------------------------
The vendor has been informed.

Thursday, April 13, 2006

PowerClan 1.14 - SQL Injection


PowerClan 1.14 - SQL Injection
--------------------------------------------------------
Software: PowerClan 1.14
Version: 1.14
Type: SQL Injection
Date: Apr 13 23:37:50 CEST 2006
Vendor: powerscripts.org
Page: http://www.powerscripts.org
Risc: Middle

credits:
----------------------------
d4igoro - d4igoro[at]gmail[dot]com
http://d4igoro.blogspot.com/

vulnerability:
----------------------------
magic_quotes_gpc = off
http://[target]/member.php?pcpage=showmember&memberid=[SQL]

solution:
----------------------------
member.php
fix $memberid

notes:
----------------------------
The vendor has been informed.

planetSearch+ - XSS Vulnerabilities


planetSearch+ - XSS Vulnerabilities
--------------------------------------------------------
Software: planetSearch+
Version: 26.10.2005
Type: Cross Site Scripting Vulnerability
Date: Apr 13 20:44:54 CEST 2006
Vendor: PlaNet Concept e.K.
Page: http://www.planetc.de
Risc: Low

credits:
----------------------------
d4igoro - d4igoro[at]gmail[dot]com
http://d4igoro.blogspot.com/
Greetz: kara & hm

vulnerability:
----------------------------
http://[target]/planetsearchplus.php?search_exp=[XSS]

solution:
----------------------------
planetsearchplus.php
fix $search_exp

notes:
----------------------------
The vendor has been informed.

googledork:
----------------------------
intitle:"planetSearch+"

Tuesday, April 11, 2006

latest php-shells i found

http://doudak.persiangig.com/cs.ipg?&cmd=id
http://www.deltashadowforce.com/includes/c?cmd=id
http://sonorauto.com.br/tool25.gif
http://spyval.com/cse.gif
http://tools.kit.net/cmd.txt
http://ecidade.com.br/images/xpl/lila.jpg
http://hackervend3r.tripod.com/oke.txt
http://hitam-putih.info/saben.jpg
http://kicflex.com/image/.nd/c99last.txt
http://www.nicwilson0.plus.com/temp/reel.txt

Tritanium Bulletin Board 1.2.3 - XSS


Tritanium Bulletin Board 1.2.3 - XSS Vulnerabilities
--------------------------------------------------------
Software: Tritanium Bulletin Board 1.2.3
Version: 1.2.3
Type: Cross Site Scripting Vulnerability
Date: Die Apr 11 21:57:50 CEST 2006
Vendor: tritanium
Page: http://www.tritanium-scripts.com/
Risc: Low

credits:
----------------------------
d4igoro - d4igoro[at]gmail[dot]com
http://d4igoro.blogspot.com/

vulnerability:
----------------------------
register_globals On

http://[target]/index.php?faction=register&newuser_name=[XSS]
http://[target]/index.php?faction=register&newuser_email=[XSS]
http://[target]/index.php?faction=register&newuser_hp=[XSS]

solution:
----------------------------
register.php
line 26-33 : better validating

notes:
----------------------------
The vendor has been informed.

googledork:
----------------------------
"2001/2002 Tritanium Scripts"

Manila - XSS Vulnerabilities


Manila <= 9.5 - XSS Vulnerabilities
--------------------------------------------------------
Software: Manila
Version: <= 9.5
Type: Cross Side Scripting Vulnerability
Date: Die Apr 11 21:33:54 CEST 2006
Vendor: UserLand Software
Page: http://manila.userland.com/
Risc: Middle

credits:
----------------------------
d4igoro - d4igoro[at]gmail[dot]com
http://d4igoro.blogspot.com/

vulnerability:
----------------------------
http://[target]/discuss/msgReader$1?mode=[XSS]
http://[target]/newsItems/viewDepartment$[XSS]

solution:
----------------------------
There isn't a solution yet.

notes:
----------------------------
At the time of posting no known official patches are available for this vulnerability.
The vendor has been informed.