SummaryMySQLguest by "Allwebscripts is a guestbook script that uses MySQL to store messages".& N& W( ?8 @7 C
/ v ]& [8 w+ F. AAllwebscripts' MySQLguest is vulnerable to a source code injection vulnerability in the AWSguest.php page. The vulnerability occurs as fields in the AWSguest.php page do not adequately sanitize HTML, script or PHP code.
; ~, M9 M& R0 F1 h& z0 a7 S, C# l, o) |; ]; C5 a O
DetailsIn the AWSguest.php page, any of the following fields can be used to inject arbitrary HTML, JavaScript or PHP: "Name", "Email", "Homepage" and "Comments".& u% A7 m6 F7 ~! d$ ~
1 |1 E1 E+ B! ?Exploit:3 _9 g! F6 D( j6 i) _! {E-mail: <?php echo <p>Hello World</p>' V' ^8 R) E3 I, a6 ~; I1 e
Homepage: <script language=javascript>alert ("Messagebox") }* @6 ^* C$ D, i
Comments: <IFRAME SRC=www.computerknights.org>! t# K$ x8 F! H: T. |
2 A2 S( S/ `1 {
Additional informationThe information has been provided by BliZZard.
IP卡
狗仔卡
发表于 2004-10-6 09:52
转播
淘帖
分享
收藏
支持
反对
微信
提升卡
置顶卡
沉默卡
喧嚣卡
变色卡
抢沙发
显身卡
