Home page logo
/

bugtraq logo Bugtraq mailing list archives

[eVuln] QLnews XSS and PHP Code Insertion Vulnerabilities
From: alex () evuln com
Date: 12 Apr 2006 08:18:21 -0000

New eVuln Advisory:
QLnews XSS and PHP Code Insertion Vulnerabilities
http://evuln.com/vulns/113/summary.html

--------------------Summary----------------
eVuln ID: EV0113
CVE: CVE-2006-1575 CVE-2006-1576
Software: QLnews
Sowtware's Web Site: http://www.vscripts.pl/
Versions: 1.2
Critical Level: Dangerous
Type: Multiple Vulnerabilities
Class: Remote
Status: Unpatched. No reply from developer(s)
PoC/Exploit: Available
Solution: Not Available
Discovered by: Aliaksandr Hartsuyeu (eVuln.com)

-----------------Description---------------
1. Cross-Site Scripting.

Vulnerable Script: news.php

Parameters autorx, newsx are not properly sanitized. This can be used to post arbitrary HTML or web script code.


2. PHP Code Insertion.

Administrator has an ability to edit variable values in config.php file. This can be used to insert arbitrary PHP code 
into config file which executes by every php-script.

System access is possible.

Condition: magic_quotes_gpc = off


--------------PoC/Exploit----------------------
Available at: http://evuln.com/vulns/113/exploit.html

--------------Solution---------------------
No Patch available.

--------------Credit-----------------------
Discovered by: Aliaksandr Hartsuyeu (eVuln.com)


Regards,
Aliaksandr Hartsuyeu
http://evuln.com - Penetration Testing Services
.


  By Date           By Thread  

Current thread:
  • [eVuln] QLnews XSS and PHP Code Insertion Vulnerabilities alex (Apr 12)
[ Nmap | Sec Tools | Mailing Lists | Site News | About/Contact | Advertising | Privacy ]
AlienVault