Description - [V]Book Multiple Vulnerabilities

Multiple Vulnerabilities found in [V]Book script.

Exploit

Available

Solution

Not available - check vendor's website

1. SQL Injection.

Vulnerable script: index.php

Parameter x is not properly sanitized before being used in SQL query. This can be used to evaluate arbitrary SQL expression.

Condition: magic_quotes_gpc = off


2. Multiple Cross-Site Scripting.

Vulnerable Script: index.php

Parameters autor, www, temat, tresc are not properly sanitized. This can be used to post arbitrary HTML or web script code.


3. PHP Code Insertion.

Administrator has an ability to edit variable values from config.php file. This can be used to insert arbitrary PHP code into config file which executes by every php-script.

System access is possible.

Condition: magic_quotes_gpc = off