Home page logo
/

fulldisclosure logo Full Disclosure mailing list archives

Re: LabWiki <= 1.1 Multiple Vulnerabilitie
From: Henri Salo <henri () nerv fi>
Date: Tue, 22 Nov 2011 00:21:51 +0200

On Wed, Nov 09, 2011 at 10:42:01AM +0100, muuratsalo experimental hack lab wrote:
------------------------------------------------------------------------
LabWiki <= 1.1 Multiple Vulnerabilities
------------------------------------------------------------------------

author............: muuratsalo (Revshell.com)
contact...........: muuratsalo[at]gmail[dot]com
download..........: http://www.bioinformatics.org/phplabware/labwiki/index.php


[0x01] Vulnerability overview:

All versions of LabStore <= 1.1 are affected by multiple vulnerabilities.


[0x02] Disclosure timeline:

[08/11/2011] - Multiple vulnerabilities discovered and reported to the vendor.
[08/11/2011] - The vendor confirmed the vulnerabilities and he is
working on fixing the reported issues.
[09/11/2011] - Public Disclosure


[0x03] Vulnerabilities:

-- Shell Upload Vulnerability --
The upload script /edit.php improperly checks the filetype of uploaded images.
A 'shell.php.gif' is accepted.  /* -- note that access to edit.php
could be restricted-- */

-- Multiple Cross Site Scripting Vulnerabilities --
http://localhost/LabWiki/index.php?from=";></><script>alert('muuratsalo')</script>&help=true&page=What_is_wiki
http://localhost/LabWiki/recentchanges.php?nothing=nothing&page_no=";></><script>alert('muuratsalo')</script>

CVE-identifiers assigned: http://seclists.org/oss-sec/2011/q4/370

Best regards,
Henri Salo

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/


  By Date           By Thread  

Current thread:
[ Nmap | Sec Tools | Mailing Lists | Site News | About/Contact | Advertising | Privacy ]
AlienVault