2daybiz Network Community Script SQL Injection / Cross Site Scripting

2011.11.09
Risk: High
Local: No
Remote: Yes
CWE: CWE-89


CVSS Base Score: 7.5/10
Impact Subscore: 6.4/10
Exploitability Subscore: 10/10
Exploit range: Remote
Attack complexity: Low
Authentication: No required
Confidentiality impact: Partial
Integrity impact: Partial
Availability impact: Partial

=========================================================== 2daybiz Network Community Script SQLi AND XSS Vulnerability =========================================================== 1-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=0 0 _ __ __ __ 1 1 /' \ __ /'__`\ /\ \__ /'__`\ 0 0 /\_, \ ___ /\_\/\_\ \ \ ___\ \ ,_\/\ \/\ \ _ ___ 1 1 \/_/\ \ /' _ `\ \/\ \/_/_\_<_ /'___\ \ \/\ \ \ \ \/\`'__\ 0 0 \ \ \/\ \/\ \ \ \ \/\ \ \ \/\ \__/\ \ \_\ \ \_\ \ \ \/ 1 1 \ \_\ \_\ \_\_\ \ \ \____/\ \____\\ \__\\ \____/\ \_\ 0 0 \/_/\/_/\/_/\ \_\ \/___/ \/____/ \/__/ \/___/ \/_/ 1 1 \ \____/ >> Exploit database separated by exploit 0 0 \/___/ type (local, remote, DoS, etc.) 1 1 1 0 [+] Site : Inj3ct0r.com 0 1 [+] Support e-mail : submit[at]inj3ct0r.com 1 0 0 1 ########################################## 1 0 I'm Sid3^effects member from Inj3ct0r Team 1 1 ########################################## 0 0-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-==-=-=-1 Name : 2daybiz Network Community Script SQLi AND XSS Vulnerability Date : june, 16 2010 Vendor url :http://www.2daybiz.com/networkcommunityscript.html Critical Level : HIGH Author : Sid3^effects aKa HaRi <shell_c99[at]yahoo.com> special thanks to : r0073r (inj3ct0r.com),L0rd CruSad3r,MaYur,gunslinger_ greetz to :All ICW members and my friends :) luv y0 guyz ####################################################################################################### DESCRIPTION: 2daybiz Network Community Script has all the features needed to run a successful social networking community like Orkut. The features include customizing member profile, upload pictures, inviting friends to join their network, create groups with different access levels, chat in public or private rooms, and create forums, events, classifieds, and blog. Network Community Script makes it easy to find people who share their hobbies and interests, look for dating partners or to establish new business contacts. The user can also create and join a wide variety of online communities to discuss current events, reconnect with old friends or even exchange your favorite recipes. ####################################################################################################### Xploit: SQLI Vulnerability DEMO URL : http://2daybiz.com/products/orkutclone/view_photo.php?page=3&alb=[SQLI] ############################################################################################################### Xploit: XSS Vulnerability Attack Pattern: '"--> DEMO URL :http://2daybiz.com/products/orkutclone/scrapbook.php?id=[XSS] ############################################################################################################### # 0day no more # Sid3^effects

References:

http://xforce.iss.net/xforce/xfdb/59496
http://www.securityfocus.com/bid/40913
http://www.packetstormsecurity.com/1006-exploits/2daybiz-sqlxss.txt
http://secunia.com/advisories/40247


Vote for this issue:
50%
50%


 

Thanks for you vote!


 

Thanks for you comment!
Your message is in quarantine 48 hours.

Comment it here.


(*) - required fields.  
{{ x.nick }} | Date: {{ x.ux * 1000 | date:'yyyy-MM-dd' }} {{ x.ux * 1000 | date:'HH:mm' }} CET+1
{{ x.comment }}

Copyright 2020, cxsecurity.com

 

Back to Top