PHPKIT Multiple Input Validation Vulnerabilities

Bugtraq ID:	11725
Class:	Input Validation Error
CVE:
Remote:	Yes
Local:	No
Published:	Nov 22 2004 12:00AM
Updated:	Nov 22 2004 12:00AM
Credit:	Discovery of these vulnerabilities is credited to Steve <[email protected]>.
Vulnerable:	PHPKIT PHPKIT 1.6.1 PHPKIT PHPKIT 1.6 .03 PHPKIT PHPKIT 1.6 .02
Not Vulnerable:

PHPKIT Multiple Input Validation Vulnerabilities

It is reported that PHPKIT is susceptible to cross-site scripting and SQL injection vulnerabilities.

The cross-site scripting issue is present in a parameter of the 'popup.php' script. An attacker can exploit this issue by creating a malicious link containing HTML and script code and send this link to a vulnerable user. This can allow for theft of cookie-based authentication credentials and other attacks.

An SQL injection issue exists in the application as well. This issue affects a parameter of the 'print.php' script. Due to this, attackers may supply malicious parameters to manipulate the structure and logic of SQL queries.

PHPKIT Multiple Input Validation Vulnerabilities

The following examples are available:

http://www.example.com/phpkit/popup.php?img="><script>alert(document.cookie)</script>
http://www.example.com/phpkit/include.php?path=guestbook/print.php&id=1'

PHPKIT Multiple Input Validation Vulnerabilities

Solution:
Currently we are not aware of any vendor-supplied patches for this issue. If you feel we are in error or are aware of more recent information, please mail us at: [email protected] <mailto:[email protected]>.

PHPKIT Multiple Input Validation Vulnerabilities

References:

• PHPKIT Homepage (PHPKIT)
  
• PHPKIT SQL Injection, XSS (Steve )