AOH :: HP Unsorted S :: C07-2468.HTM

sitex multiple vulnerabilities
sitex multiple vulnerabilities
sitex multiple vulnerabilities

global risk:critical

upload vulnerability:
in user profile upload an avatar with a double extension like :
once it's done,you gone get an error like:Fatal error: Call to undefined function imagedestroy() in /.
but the last extension (jpg) will be removed by the script, and stored in :
has ramdom_numberfile.php

xss get :

xss via mysql error:

full path disclosure:

multiples errors sql :
just add a ' on any var .. 
or on any fields ( like in forum,search,...etc )

regards laurent gaffi=E9

The entire AOH site is optimized to look best in Firefox® 3 on a widescreen monitor (1440x900 or better).
Site design & layout copyright © 1986-2015 AOH
We do not send spam. If you have received spam bearing an email address, please forward it with full headers to