SecurityReason.com - Our Reason is

Security

Register | Forget Password | Login
Search :
SecurityReason
WLB
Services
RSS
Corporate
Note

If you have found a vulnerability, please send to our SecurityAlert Database :
secalert()securityreason()com

Also if you have new ( 0-day ) exploit, please send to our ExploitAlert Archive :
exploit()securityreason()com

Home arrow SecurityAlert Database

Arrow  Topic :

RedCMS Multiple XSS and SQL Injection Vulnerabilities


Arrow  SecurityAlert : 708
Arrow  CVE : CVE-2006-1568
Arrow  SecurityRisk : Medium  Security Risk Medium  (About)
Arrow  Remote Exploit : Yes
Arrow  Local Exploit : No
Arrow  Exploit Given : Yes
Arrow  Credit : alex evuln com
Arrow  Published : 15.04.2006

Arrow  Affected Software : RedCMS



Arrow  Advisory Text :  

New eVuln Advisory:
RedCMS Multiple XSS and SQL Injection Vulnerabilities
http://evuln.com/vulns/115/summary.html

--------------------Summary----------------
eVuln ID: EV0115
CVE: CVE-2006-1568 CVE-2006-1569
Software: RedCMS
Sowtware's Web Site: http://redcms.co.uk/
Versions: 0.1
Critical Level: Moderate
Type: Multiple Vulnerabilities
Class: Remote
Status: Unpatched. No reply from developer(s)
PoC/Exploit: Available
Solution: Not Available
Discovered by: Aliaksandr Hartsuyeu (eVuln.com)

-----------------Description---------------
1. Multiple Cross-Site Scripting Vulnerabilities.

Vulnerable Script:register.php

Parameters email, location, website are not properly sanitized. This can be
used to post arbitrary HTML or web script code.

2. Multiple SQL Injections.

Vulnerable scripts:
login.php
profile.php
register.php
...

Variables $username(login.php), $password(login.php), $u(profile.php),
$username(register.php), $password(register.php),... All user-defined
variables are not properly sanitized before being used in SQL queries. This
can be used to bypass authentication or make any SQL query by injecting
arbitrary SQL code.

Condition: magic_quotes_gpc = off

--------------PoC/Exploit----------------------
Available at: http://evuln.com/vulns/115/exploit.html

--------------Solution---------------------
No Patch available.

--------------Credit-----------------------
Discovered by: Aliaksandr Hartsuyeu (eVuln.com)

Regards,
Aliaksandr Hartsuyeu
http://evuln.com - Penetration Testing Services
.




Arrow  Feedback :

If you have additional information or notice any errors regarding this security advisory, please use contact form or email us at info()securityreason()com.
Alert

Multiple Vendors libc/gdtoa printf(3) Array Overrun

Security Risk High- 2009-05-30

SecurityReason realised new advisory about vulnerabilities libc/gdtoa...

Apache RSS Apache Alert

» Apache Tomcat
   RequestDispatcher
   directory traversal
   vulnerability

» Apache mod_dav / svn
   Remote Denial of Service
   Exploit

» Apache Tomcat Information
   disclosure

» Apache Tomcat User
   enumeration vulnerability
   with FORM authentication

PHP RSS PHP Alert

» PHP 5.2.9 curl safe_mode
   & open_basedir bypass

» PHP 5.2.6 SAPI
   php_getuid() overload

» PHP
   ZipArchive::extractTo()
   Directory Traversal
   Vulnerability

» PHP 5.2.6 dba_replace()
   destroying file

Copyright © SecurityReason.com. All Rights Reserved.