[V]Book Multiple Vulnerabilities

Risk: Medium
Local: Yes
Remote: Yes
CWE: CWE-Other

CVSS Base Score: 5.1/10
Impact Subscore: 6.4/10
Exploitability Subscore: 4.9/10
Exploit range: Remote
Attack complexity: High
Authentication: No required
Confidentiality impact: Partial
Integrity impact: Partial
Availability impact: Partial

New eVuln Advisory: [V]Book Multiple Vulnerabilities http://evuln.com/vulns/111/summary.html --------------------Summary---------------- eVuln ID: EV0111 CVE: CVE-2006-1561 CVE-2006-1562 CVE-2006-1563 Software: [V]Book Sowtware's Web Site: http://www.vscripts.pl/?id=vbook2 Versions: 2.0 Critical Level: Dangerous Type: Multiple Vulnerabilities Class: Remote Status: Unpatched. No reply from developer(s) PoC/Exploit: Available Solution: Not Available Discovered by: Aliaksandr Hartsuyeu (eVuln.com) -----------------Description--------------- 1. SQL Injection. Vulnerable script: index.php Parameter x is not properly sanitized before being used in SQL query. This can be used to evaluate arbitrary SQL expression. Condition: magic_quotes_gpc = off 2. Multiple Cross-Site Scripting. Vulnerable Script: index.php Parameters autor, www, temat, tresc are not properly sanitized. This can be used to post arbitrary HTML or web script code. 3. PHP Code Insertion. Administrator has an ability to edit variable values from config.php file. This can be used to insert arbitrary PHP code into config file which executes by every php-script. System access is possible. Condition: magic_quotes_gpc = off --------------PoC/Exploit---------------------- Available at: http://evuln.com/vulns/111/exploit.html --------------Solution--------------------- No Patch available. --------------Credit----------------------- Discovered by: Aliaksandr Hartsuyeu (eVuln.com) Regards, Aliaksandr Hartsuyeu http://evuln.com - Penetration Testing Services .

Vote for this issue:


Thanks for you vote!


Thanks for you comment!
Your message is in quarantine 48 hours.

Comment it here.

(*) - required fields.  
{{ x.nick }} | Date: {{ x.ux * 1000 | date:'yyyy-MM-dd' }} {{ x.ux * 1000 | date:'HH:mm' }} CET+1
{{ x.comment }}

Copyright 2023, cxsecurity.com


Back to Top