|
|
PHPX Multiple Input Validation Vulnerabilities
To exploit a cross-site scripting issue, an attacker entices an unsuspecting user into following a malicious URI. To exploit an SQL-injection issue, the attacker can use a browser. The following proof-of-concept URIs are available: http://www.example.com/phpx/gallery.php?action=viewImage&image_id=' http://www.example.com/phpx/news.php?action=view&news_id=' http://www.example.com/phpx/news.php?news_cat_id='&action=view_cat http://www.example.com/phpx/users.php?action=view&user_id=' http://www.example.com/phpx/news.php?news_id=' http://www.example.com/phpx/forums.php?cat_id=' http://www.example.com/phpx/forums.php?forum_id=1&topic_id=' http://www.example.com/phpx/forums.php?forum_id=1&topic_id=1&post_id=' http://www.example.com/phpx/news.php?action=view_cat&news_cat_id=' http://www.example.com/phpx/gallery.php?action=viewCat&cat_id=' http://www.example.com/phpx/print.php?action=news&news_id=' The following exploit code is available: |
|
Privacy Statement |