phpBugTracker 0.9 – ‘bug.php’ Multiple Cross-Site Scripting Vulnerabilities

phpBugTracker 0.9 – ‘bug.php’ Multiple Cross-Site Scripting Vulnerabilities

漏洞ID 1054449 漏洞类型
发布时间 2004-04-15 更新时间 2004-04-15
图片[1]-phpBugTracker 0.9 – ‘bug.php’ Multiple Cross-Site Scripting Vulnerabilities-安全小百科CVE编号 N/A
图片[2]-phpBugTracker 0.9 – ‘bug.php’ Multiple Cross-Site Scripting Vulnerabilities-安全小百科CNNVD-ID N/A
漏洞平台 PHP CVSS评分 N/A
|漏洞来源
https://www.exploit-db.com/exploits/24005
|漏洞详情
漏洞细节尚未披露
|漏洞EXP
source: http://www.securityfocus.com/bid/10153/info
  
Reportedly phpBugTracker contains multiple input validation vulnerabilities; it is prone to multiple SQL injection, cross-site scripting and HTML injection issues. These issues are all due to a failure of the application to properly sanitize user supplied input.
  
The SQL injection issues may allow a remote attacker to manipulate query logic, potentially leading to unauthorized access to sensitive information such as the administrator password hash or corruption of database data. SQL injection attacks may also potentially be used to exploit latent vulnerabilities in the underlying database implementation.
  
The cross-site scripting and HTML injection issues may allow an attacker to execute arbitrary script code in the browser of an unsuspecting user. It may be possible to steal the unsuspecting user's cookie-based authentication credentials, as well as other sensitive information. Other attacks may also be possible.

http://www.example.com/bug.php?op=show&bugid=[XSS]
http://www.example.com/bug.php?op=vote&bugid=[XSS]
http://www.example.com/bug.php?op=viewvotes&bugid=[XSS]
http://www.example.com/bug.php?op=add&project=[XSS]

相关推荐: Symantec PCAnywhere Chat Client Privilege Escalation Vulnerability

Symantec PCAnywhere Chat Client Privilege Escalation Vulnerability 漏洞ID 1099238 漏洞类型 Access Validation Error 发布时间 2003-11-17 更新时间 …

© 版权声明
THE END
喜欢就支持一下吧
点赞0
分享