Ublog Reload Admin Panel Multiple HTML Injections
Ublog Reload Admin Panel Multiple HTML Injections
Ublog Reload has been developed to run exclusively on web sites hosted on
Windows Servers with Internet Information Server 4.0 or higher and ASP 3.0
installed. No other Platforms are supported. Ublog Reload supports Microsoft
Access, Microsoft Sql Server and MySql Server databases. Ublog Reload, MySql
version, require MyODBC driver installed on Windows Servers. This may help the
attacker steal cookie-based authentication credentials and launch other
attacks. A successful exploit could allow an attacker to compromise the
application, access or modify data, or exploit vulnerabilities in the
underlying database implementation.
Hackers Center Security Group (http://www.hackerscenter.com)
Credit: Doz
Remote: Yes
Local: Yes
Class: Cross-Site Scripting
Version: Ublog Reload 1.0.5
vendor: www.uapplication.com
Attackers can exploit these issues via a web client.
Remote XSS: http://www.example.com/path/UblogReload/login.asp
Local XSS: These Pages Contail XSS Vul Forms.
/UblogReload/badword.asp
/UblogReload/polls.asp
UblogReload/users.asp
Local SQL: Pages Containing SQL Invalid Inputs.
/UblogReload/badword.asp Contains SQL Holes
Demo: http://www.uapplication.com/demo/UblogReload/
Security researcher? Join us: mail Zinho at zinho at hackerscenter.com
Refrence: http://www.hackerscenter.com/archive/view.asp?id=27270