php-handicapper.txt

`------------------------------------------------------  
Nightmare TeAmZ Advisory 013  
------------------------------------------------------  
Date - 10/2005  
PHP HANDICAPPER Multiple Vulnerability  
  
  
AFFECTED PRODUCTS  
=================  
PHP HANDICAPPER  
http://www.phphandicapper.com  
  
  
OVERVIEW  
========  
Out Of The Box Complete Website, Easily Automate Your Sports Picks / Sports   
Information Predictions. All sports - football,basketball,boxin g,baseball,   
college, pro etc. Offer your services like daily, weekly or seasonal   
selections. Payments to you and member process is automated. Detail your   
plays like side,total parlay, time of event,comments and more. Auto-tracking   
of wins and losses. There are built in live scores, Faq's,free picks page,   
and full control of the sites look with header, built in html editor, and   
logo manager. Members login has details of their account service(s) ordered,   
picks, and messages to them. Services expire but members dont, so they can   
always purchase more picks on their account. Online Demo, Optional Free   
Installation And Free Hosting Available.  
  
Vulnerability:  
========  
1.Sql Injection  
2. Xss  
3.CRLF injection  
  
Overwiew:  
========  
1.  
An unauthenticated attacker may execute arbitrary SQL statements on the   
vulnerable system. This may compromise the integrity of your database and   
expose sensitive information  
2.  
Malicious users may inject JavaScript, VBScript, ActiveX, HTML or Flash into   
a vulnerable application to fool a user in order to gather data from them.  
3.  
This script is possible vulnerable to CRLF injection attacks. Is it possible   
for a remote attacker to inject custom HTTP headers.  
  
Exemple:  
========  
1.  
http://www.phphandicapper.com/front//process_signup.php?serviceid=[SQL]  
2.  
http://www.phphandicapper.com/front/msg.php?msg=[XSS]  
3.  
http://www.phphandicapper.com/front//process_signup.php?login=[CRLF]  
  
  
Solution:  
=========  
1. Venditor Not Contacted  
  
  
Credits  
=======  
This vulnerability was discovered and researched by  
BiPi_HaCk of Nightmare TeAmZ  
We're: BiPi_HaCk - r3d_4Ss4ult3r - Sub_Z3r0  
Site: http://www.NightmareTeAmZ.altervista.org <--IT Security Forum  
  
_________________________________________________________________  
Ricerche online più semplici e veloci con MSN Toolbar!   
http://toolbar.msn.it/  
`