CS-Forum <= 0.81 Cross Site Scripting, SQL Injection, Full Path
Date: 11 Jun 2006 17:30:37 -0000
From: [email protected]
To: [email protected]
Subject: CS-Forum <= 0.81 Cross Site Scripting, SQL Injection, Full Path
Disclosure
X-Virus-Scanned: antivirus-gw at tyumen.ru
Cross Site Scripting
********************
http://[...]/read.php?msg_result=[XSS]
http://[...]/read.php?rep_titre=">[XSS]
Cookies: CSForum_nom=">[XSS]; CSForum_mail=">[XSS]; CSForum_url=">[XSS]
SQL Injection
*************
http://[...]/read.php?id=1'[SQL_SELECT]&debut=[SQL_LIMIT]
http://[...]/index.php?search=%'[SQL_SELECT]%23
http://[...]/index.php?debut=1[SQL] //Digit -> Without quote
Full Path Disclosure
********************
http://[...]/index.php?readall=&collapse[]= //setcookie()
Solution
********
SQL Injection => addslashes() / intval()
Cross Site Scripting => htmlentities()
Full Path Disclosure => is_string()
Credits
*******
by DarkFig -- http://www.acid-root.new.fr/advisories/csforum081.txt
Changelog
*********
[06-06-11] -- Vendor contacted
