------------------------------------------------------ Nightmare TeAmZ Advisory 013 ------------------------------------------------------ Date - 10/2005 PHP HANDICAPPER Multiple Vulnerability AFFECTED PRODUCTS ================= PHP HANDICAPPER http://www.phphandicapper.com OVERVIEW ======== Out Of The Box Complete Website, Easily Automate Your Sports Picks / Sports Information Predictions. All sports - football,basketball,boxin g,baseball, college, pro etc. Offer your services like daily, weekly or seasonal selections. Payments to you and member process is automated. Detail your plays like side,total parlay, time of event,comments and more. Auto-tracking of wins and losses. There are built in live scores, Faq's,free picks page, and full control of the sites look with header, built in html editor, and logo manager. Members login has details of their account service(s) ordered, picks, and messages to them. Services expire but members dont, so they can always purchase more picks on their account. Online Demo, Optional Free Installation And Free Hosting Available. Vulnerability: ======== 1.Sql Injection 2. Xss 3.CRLF injection Overwiew: ======== 1. An unauthenticated attacker may execute arbitrary SQL statements on the vulnerable system. This may compromise the integrity of your database and expose sensitive information 2. Malicious users may inject JavaScript, VBScript, ActiveX, HTML or Flash into a vulnerable application to fool a user in order to gather data from them. 3. This script is possible vulnerable to CRLF injection attacks. Is it possible for a remote attacker to inject custom HTTP headers. Exemple: ======== 1. http://www.phphandicapper.com/front//process_signup.php?serviceid=[SQL] 2. http://www.phphandicapper.com/front/msg.php?msg=[XSS] 3. http://www.phphandicapper.com/front//process_signup.php?login=[CRLF] Solution: ========= 1. Venditor Not Contacted Credits ======= This vulnerability was discovered and researched by BiPi_HaCk of Nightmare TeAmZ We're: BiPi_HaCk - r3d_4Ss4ult3r - Sub_Z3r0 Site: http://www.NightmareTeAmZ.altervista.org <--IT Security Forum _________________________________________________________________ Ricerche online pił semplici e veloci con MSN Toolbar! http://toolbar.msn.it/