Home page logo
/

bugtraq logo Bugtraq mailing list archives

Tiny PHP forum - vulns
From: hessam () hessamx net
Date: 17 Apr 2006 12:28:06 -0000

~ Summery :
------------------------------
Name          : Tiny PHP forum v3.6
Software      : http://sourceforge.net/projects/tinyphpforum/
Discovered by : Hessam-x (Hessam M.Salehi) - www.hessamx.net

~ Vulnerabilities :
------------------------------
I. Cross-site Scripting
 A.Input code to the "uname" in profile.php
profile.php?action=view&uname=<script>alert("Xss")</script>
 B.input code in login name and login , in erorr page you can see xss code!

II. Access to hash password
This use very bad method for save hash password.
user's password save in a file,for example admin's password
saved in this file :
http://localhost/tpforum/users/admin.hash

Iran Hackerz Security Team , 2006-04-16


  By Date           By Thread  

Current thread:
  • Tiny PHP forum - vulns hessam (Apr 17)
[ Nmap | Sec Tools | Mailing Lists | Site News | About/Contact | Advertising | Privacy ]
AlienVault