Exploit CoolForum 0.5/0.7/0.8 - 'avatar.php?img' Cross-Site Scripting

[Exploiter]

EDB-ID

25239

Проверка EDB

1. Пройдено

Автор

ROMANO

Тип уязвимости

WEBAPPS

Платформа

PHP

CVE

cve-2005-0857

Дата публикации

2005-03-19

source: https://www.securityfocus.com/bid/12852/info

Multiple remote input validation vulnerabilities affect CoolForum. These issues are due to a failure of the application to properly sanitize user-supplied input prior to using it to carry out critical functionality.

Multiple SQL injection vulnerabilities have been reported and a cross-site scripting vulnerability is also reported.

An attacker may leverage these issues to manipulate and view arbitrary database contents by exploiting the SQL injection issues, and to have arbitrary script code executed in the browser of an unsuspecting user by exploiting the cross-site scripting vulnerabilities. 

avatar.php?img=<script>alert(document.cookie)</script>