EZDatabase.txt

`Synopsis: EZDatabase directory transversal, XSS and path disclosure  
vulnerability  
  
Product: EZDatabase  
http://www.ezdatabase.org  
  
Version: Confirmed on EZDatabase < 2.1.2  
  
Author: Josh Zlatin-Amishav  
  
Date: January 15, 2006  
  
Background:  
Written in PHP and MySQL, ezDatabase is the foundation for your online  
databases. It is a powerful web based application that allows even  
non-technical users to create online databases for their website.  
ezDatabase will do the hard work while you concentrate on building the  
databases you want.  
  
Issue:  
The $p variable is not properly sanitized in index.php. Note the code in  
index.php tacks on a ".php" to any file requested.  
  
PoC:  
http://localhost/index.php?db_id=1&cat_id=1&display=30&p=%3Cscript%3Ealert(document.cookie)%3C/script%3E&rowstart=90  
  
References:  
http://www.ezdatabase.org  
http://zur.homelinux.com/Advisories/ezdatabase_dir_trans.txt  
`