eFiction多个远程输入验证漏洞

QQ空间 新浪微博 微信 QQ facebook twitter
漏洞ID 1109310 漏洞类型 跨站脚本
发布时间 2005-11-25 更新时间 2006-01-19
CVE编号 CVE-2005-4167 CNNVD-ID CNNVD-200512-211
漏洞平台 PHP CVSS评分 4.3
|漏洞来源
https://www.exploit-db.com/exploits/26591
http://www.cnnvd.org.cn/web/xxk/ldxqById.tag?CNNVD=CNNVD-200512-211
|漏洞详情
eFiction是一款基于Web的远程协同写作的工具。eFiction处理用户请求时存在多个输入验证漏洞,远程攻击者可能利用此漏洞在服务器上以Web进程权限执行任意命令或执行SQL注入攻击。eFiction的文件上传模块在处理上传文件时没能正确检查文件的扩展名,远程攻击者可以上传php后缀的可执行代码,从而使攻击者可以执行任意指令。eFiction的authors.php、viewstory.php、viewuser.php脚本没有对用户提交的参数数据做充分的检测过滤,攻击者可以通过在输入数据中插入特定的SQL代码非授权操作数据库。
|漏洞EXP
source: http://www.securityfocus.com/bid/15568/info

eFiction is prone to SQL injection, remote file upload, and cross site scripting vulnerabilities.

These vulnerabilities may allow an attacker to view and modify sensitive information, gain unauthorized access, modify and corrupt the underlying database application, and obtain a victim's authentication credentials.

eFiction versions 1.0, 1.1 and 2.0 are reported to be vulnerable; other versions may also be affected. 

http://www.example.com/efiction/titles.php?action=viewlist&let=<script>alert(document.cookie)</script>
|参考资料

来源:BID
名称:15568
链接:http://www.securityfocus.com/bid/15568
来源:www.efiction.wallflowergirl.com
链接:http://www.efiction.wallflowergirl.com/forums/viewtopic.php?t=1555
来源:SECUNIA
名称:17777
链接:http://secunia.com/advisories/17777
来源:MISC
链接:http://rgod.altervista.org/efiction2_xpl.html
来源:BUGTRAQ
名称:20051125eFiction<=2.0multiplevulnerabilities
链接:http://archives.neohapsis.com/archives/bugtraq/2005-11/0301.html