0day.today - Biggest Exploit Database in the World.
- We use one main domain: http://0day.today
- Most of the materials is completely FREE
- If you want to purchase the exploit / get V.I.P. access or pay for any other service,
you need to buy or earn
GOLD
Administration of this site uses the official contacts. Beware of impostors!
We DO NOT use Telegram or any messengers / social networks!Please, beware of scammers!
- Read the [ agreement ]
- Read the [ Submit ] rules
- Visit the [ faq ] page
- [ Register ] profile
- Get [ GOLD ]
- If you want to [ sell ]
- If you want to [ buy ]
- If you lost [ Account ]
- Any questions [ admin@0day.today ]
- Authorisation page
- Registration page
- Restore account page
- FAQ page
- Contacts page
- Publishing rules
- Agreement page
Mail:
Facebook:
Twitter:
Telegram:
We DO NOT use Telegram or any messengers / social networks!
Contact us
You can contact us by:
Mail:
Facebook:
Twitter:
Telegram:
We DO NOT use Telegram or any messengers / social networks!
Lightweight News Portal [LNP] 1.0b Multiple Remote Vulnerabilities
[================================================================== Lightweight News Portal [LNP] 1.0b Multiple Remote Vulnerabilities ================================================================== Exploit found by sToRm LNP: Lightweight news Portal v1.0-BETA Multiple Remote Vulnerabilities Cross-Site Scripting -------------------- show_photo.php?photo="><script>javascript:alert(document.domain)</script> show_potd.php?potd="><script>javascript:alert(document.domain)</script> Insecure Administration ----------------------- The admin page faces us with a login, but many important functions are allowed to be executed without a logged-in session. admin.php?A=potd_delete admin.php?A=potd admin.php?A=vote_update admin.php?A=vote admin.php?A=modifynews Permanent Code Injection ------------------------ admin.php?A=vote "Current question" field allows for code injection, allowing us to force all users browsing the poll to view an XSS or browser exploit. File Upload ----------- admin.php?A=potd The "picture of the day" manager allows for further images to be uploaded, but does not check for image validity. Although a phpshell cannot be executed through this method, a source may be uploaded for inclusion in further attacks, possibly an LFI somewhere on the server. # 0day.today [2024-11-15] #