<<< Date Index >>>     <<< Thread Index >>>

Ublog Reload Admin Panel Multiple HTML Injections



Ublog Reload Admin Panel Multiple HTML Injections


Ublog Reload has been developed to run exclusively on web sites hosted on 
Windows Servers with Internet Information Server 4.0 or higher and ASP 3.0 
installed. No other Platforms are supported. Ublog Reload supports Microsoft 
Access, Microsoft Sql Server and MySql Server databases. Ublog Reload, MySql 
version, require MyODBC driver installed on Windows Servers. This may help the 
attacker steal cookie-based authentication credentials and launch other 
attacks. A successful exploit could allow an attacker to compromise the 
application, access or modify data, or exploit vulnerabilities in the 
underlying database implementation.



Hackers Center Security Group (http://www.hackerscenter.com)
Credit: Doz



Remote: Yes
Local: Yes
Class: Cross-Site Scripting



Version: Ublog Reload 1.0.5
vendor: www.uapplication.com




Attackers can exploit these issues via a web client.


Remote XSS: http://www.example.com/path/UblogReload/login.asp



Local XSS: These Pages Contail XSS Vul Forms.


/UblogReload/badword.asp

/UblogReload/polls.asp

UblogReload/users.asp


Local SQL: Pages Containing SQL Invalid Inputs.

/UblogReload/badword.asp Contains SQL Holes


Demo: http://www.uapplication.com/demo/UblogReload/


Security researcher? Join us: mail Zinho at zinho at hackerscenter.com

Refrence: http://www.hackerscenter.com/archive/view.asp?id=27270