FLVPlayer8.txt

2006-07-13T00:00:00
ID PACKETSTORM:48228
Type packetstorm
Reporter Zero
Modified 2006-07-13T00:00:00

Description

                                        
                                            `Produce : FLV Players 8  
Website : http://www.videospark.com  
  
[+] Fullpath Disclosure :  
  
1) http://localhost/flv8/paginate.php  
  
Fatal error: Class simplepagemaker: Cannot inherit from undefined class object in /var/www/zero/httpdocs/flv8/paginate.php on line 45  
  
2) http://localhost/flv8/player.php?p=somthing  
  
atal error: SimplePageMaker::make() - out of bounds in page chihaja in /var/www/zero/httpdocs/flv8/paginate.php on line 131  
  
  
[+] Multiple Cross Site Scripting   
  
PoC :  
  
http://localhost/flv8/player.php?url=[XSS]  
http://localhost/flv8/popup.php?url=%3C/title%3E[XSS]  
http://localhost/flv8/popup.php?url=%22%3E%3C[XSS]  
  
Mourad   
  
Contact : xzerox@linuxmail.org  
  
Moroccan Security Research Team  
`