• Summary
• Description
• PoC/ Exploit
• Solution

Description - Multiple Vulnerabilities in VSNS Lemon

Multiple Vulnerabilities found in VSNS Lemon script.

Exploit

Available

Solution

Not available - check Tachyon website

1. SQL Injection.

Vulnerable script: functions/final_functions.php

Variable $id is not properly sanitized before being used in SQL query. This can be used to bypass authentication or make any SQL query by injecting arbitrary SQL code.

Condition: magic_quotes_gpc = off

2. Cross-Site Scripting.

Adding comment form. Parameter 'name' is not properly sanitized. This can be used to post arbitrary HTML or JavaScript code.

3. Cookie-Based Authentication Bypass.

There is a possibility to bypass authentication for pasword-protected articles. Password-checking function dont make password comparisson, just check cookie value for existance.