Tiny PHP forum - vulns Apr 17 2006 12:28PM
hessam hessamx net
~ Summery :
Name : Tiny PHP forum v3.6
Software : http://sourceforge.net/projects/tinyphpforum/
Discovered by : Hessam-x (Hessam M.Salehi) - www.hessamx.net

~ Vulnerabilities :
I. Cross-site Scripting
A.Input code to the "uname" in profile.php
B.input code in login name and login , in erorr page you can see xss code!

II. Access to hash password
This use very bad method for save hash password.
user's password save in a file,for example admin's password
saved in this file :

Iran Hackerz Security Team , 2006-04-16

[ reply ]


Privacy Statement
Copyright 2010, SecurityFocus