New eVuln Advisory:
ShoutLIVE PHP Code Execution & Multiple XSS Vulnerabilities
http://evuln.com/vulns/87/summary.html

--------------------Summary----------------
eVuln ID: EV0087
CVE: CVE-2006-0940 CVE-2006-0941
Software: ShoutLIVE
Sowtware's Web Site: http://cynic.x10hosting.com/downloadfile.php?file=phpscripts/ShoutLIVE.zip
Versions: 1.1.0
Critical Level: Dangerous
Type: PHP Code Execution
Class: Remote
Status: Unpatched. No reply from developer(s)
Exploit: Available
Solution: Not Available
Discovered by: Aliaksandr Hartsuyeu (eVuln.com)

-----------------Description---------------
1. PHP Code Execution

Vulnerable Script: savesettings.php

All user-defined variables are not sanitized before being written into settings.php
This can be used to inject arbitrary PHP code.

System access is possible.


2. Multiple Cross-Site Scripting

Vulnerable Script: post.php

All user-defined variables are not sanitized when posting new message. This can be used to inject arbitrary HTML or JavaScript code.


--------------Exploit----------------------
Available at: http://evuln.com/vulns/87/exploit.html

1. PHP Code Execution Example.

<form method=POST action=http://[host]/savesettings.php>
<input name=admin_pword value='asd"; [code] $a="'>
</form>


2. Multiple Cross-Site Scripting

URL: http://[host]/index.php
First name: [XSS]
Web Site: javascript:[script]
Message: [XSS]

--------------Solution---------------------
No Patch available.

--------------Credit-----------------------
Discovered by: Aliaksandr Hartsuyeu (eVuln.com)


Regards,
Aliaksandr Hartsuyeu
http://evuln.com - Penetration Testing Services
.