[eVuln] TinyPHPForum Multiple Vulnerabilities

2006.01.07
Risk: Low
Local: No
Remote: Yes
CWE: N/A

New eVuln Advisory: TinyPHPForum Multiple Vulnerabilities --------------------Summary---------------- Software: TinyPHPForum Sowtware's Web Site: http://www.ralpharama.co.uk/tpf/ Versions: 3.6 and earlier Critical Level: Moderate Type: Multiple Vulnerabilities Class: Remote Status: Unpatched Exploit: Available Solution: Not Available Discovered by: Aliaksandr Hartsuyeu (eVuln.com) Published: 2006.01.05 eVuln ID: EV0014 -----------------Description-------------- 1. Arbitrary script execution is possible when posting a link. Condition: visitor needs to click this link 2. Registered users information disclosure. users dir isn't hidden by .htaccess in default installation. 3. Directory Traversal is possible. (creating new user, new topic, viewing user's profile) --------------Exploit--------------------- 1. Arbitrary script execution. Example: [a]javascript:alert("hello")[/a] 2. Users information disclosure: http://host/tpf/users/anyuser.hash http://host/tpf/users/anyuser.email 3. Directory Traversal Example: Registering new user. username: http://host/tpf/profile.php?action=view&uname=../../username --------------Solution--------------------- No Patch available. --------------Credit--------------------- Original Advisory: http://evuln.com/vulns/14/summary.html Discovered by: Aliaksandr Hartsuyeu (eVuln.com)


Vote for this issue:
50%
50%


 

Thanks for you vote!


 

Thanks for you comment!
Your message is in quarantine 48 hours.

Comment it here.


(*) - required fields.  
{{ x.nick }} | Date: {{ x.ux * 1000 | date:'yyyy-MM-dd' }} {{ x.ux * 1000 | date:'HH:mm' }} CET+1
{{ x.comment }}

Copyright 2017, cxsecurity.com

 

Back to Top