AOH :: HP Unsorted I :: B06-4499.HTM

IwebNegar v1.1 Multiple vulnerabilities



IwebNegar v1.1 Multiple vulnerabilities
IwebNegar v1.1 Multiple vulnerabilities



::  IwebNegar v1.1 Multiple vulnerabilities  ::=0D
------------------------------------------------=0D
Software     : IwebNegar v1.1=0D
Website      : ----=0D
Bug Discover : Hessam-x / www.hessamx.net=0D 
=0D
I. Cross Site Scripting Vulnerability=0D
-------------------------------------------------=0D
Parameter "comment" are not properly sanitized in "comments.php".=0D
This can be used to post arbitrary HTML or web script code. =0D
 attacked by comments.php with field comment=0D
& ...=0D
=0D
II. SQL Injection Vulnerability=0D
-------------------------------------------------=0D
Parameter "id" is not properly sanitized before being used in SQL query.=0D
vulnerable Page is : "comments.php".=0D
This can be used make any SQL query by injecting arbitrary SQL code.=0D
Attacker can be execute this url :=0D
comments.php?id=[SQL Query]=0D

The entire AOH site is optimized to look best in Firefox® 3 on a widescreen monitor (1440x900 or better).
Site design & layout copyright © 1986-2014 AOH
We do not send spam. If you have received spam bearing an artofhacking.com email address, please forward it with full headers to abuse@artofhacking.com.