Home page logo
/

bugtraq logo Bugtraq mailing list archives

PhpList Sql Injection and Path Disclosure
From: thegreatone2176 () yahoo com
Date: 28 Jul 2005 00:01:05 -0000

-----------------------------------------
PhpList Sql Injection and Path Disclosure
-----------------------------------------

Vulnerabilities
---------------

1) There is an sql injection in the id parameter of public_html/lists/admin/?page=admin&id=INJECT HERE

2) Because of the heavy use of classes without proper checking of whether the script is directly called there is many 
path disclosures. The following pages are all affected under the preceding directory.

public_html/lists/admin:
about.php
connect.php
domainstats.php
usercheck.php

admin/commonlib/pages:
attributes.php
dbcheck.php
importcsv.php
user.php
usermgt.php
users.php

public_html/lists/admin/plugins:
helloworld.php
sidebar.php

public_html/lists/admin/plugsins/defaultplugin:
main.php

Solution
--------

1) cleanse the id parameter before processing

2) check to see if the script is being directly called and then have the script die

Credit
------

thegreatone2176 () yahoo com


  By Date           By Thread  

Current thread:
  • PhpList Sql Injection and Path Disclosure thegreatone2176 (Jul 28)
[ Nmap | Sec Tools | Mailing Lists | Site News | About/Contact | Advertising | Privacy ]
AlienVault