HiveMail 1.2.2/1.3 index.php - $_SERVER'PHP_SELF' XSS

ID EDB-ID:27186
Type exploitdb
Reporter GulfTech Security
Modified 2006-02-11T00:00:00


HiveMail 1.2.2/1.3 index.php $_SERVER['PHP_SELF'] XSS. CVE-2006-0758 . Webapps exploit for php platform

HiveMail is prone to multiple vulnerabilities. These vulnerabilities may allow the execution of arbitrary PHP code, cross-site scripting attacks, and SQL injection.
The PHP code-execution issues are the result of an input-validation error that may allow user-supplied PHP code to be evaluated by the interpreter.
The cross-site scripting vulnerabilities may permit a remote attacker to steal cookie-based authentication credentials from legitimate users.
The SQL-injection issues are the result of the application's failure to properly sanitize user-supplied input that will be included in SQL queries. Successful exploitation of SQL-injection vulnerabilities could allow an attacker to compromise the application, access or modify data, or exploit vulnerabilities in the underlying database implementation.;%3C/script%3E