DATE:

2/11/2005

AFFECTED PRODUCTS

PHP HANDICAPPER
http://www.phphandicapper.com

OVERVIEW

Out Of The Box Complete Website, Easily Automate Your Sports Picks /
Sports Information Predictions. All sports - football,basketball,boxin
g,baseball, college, pro etc. Offer your services like daily, weekly
or seasonal selections. Payments to you and member process is
automated. Detail your plays like side,total parlay, time of
event,comments and more. Auto-tracking of wins and losses. There are
built in live scores, Faq's,free picks page, and full control of the
sites look with header, built in html editor, and logo manager.
Members login has details of their account service(s) ordered, picks,
and messages to them. Services expire but members dont, so they can
always purchase more picks on their account. Online Demo, Optional
Free Installation And Free Hosting Available.

Vulnerability:

1.Sql Injection
2. Xss
3.CRLF injection

Overwiew:

An unauthenticated attacker may execute arbitrary SQL statements on
the vulnerable system. This may compromise the integrity of your
database and expose sensitive information
2.
Malicious users may inject JavaScript, VBScript, ActiveX, HTML or
Flash into a vulnerable application to fool a user in order to gather
data from them.
3.
This script is possible vulnerable to CRLF injection attacks. Is it
possible for a remote attacker to inject custom HTTP headers.

Exemple:

Code:
http://www.phphandicapper.com/front/process_signup.php?serviceid=[SQL]

Code:
http://www.phphandicapper.com/front/msg.php?msg=[XSS]

Code:
http://www.phphandicapper.com/front/process_signup.php?login=[CRLF]

Solution:

1. Venditor Not Contacted