Re: Moodle 1.9.3 Remote Code Execution
when try this exploit, the result is: Filter not enabled! i think, this exploit need two conditions: 1- register_globals = ON 2- text filter must be enabled
Found new bug
In GOD We Trust Kachal667 Under9round Team (KuT) Hi, Here's my(LrK) new advisory about PHP Website. PHP System - Input Data(simple XSS) vulnerabilities Date: 02/11/2005 Summary --- PHP is a language for programming and it is very good language for portal programming. we se some portal with php like: PHPBB , PHPNuke and Details --- If programmer is not professional, probably he will have make a mistake. if he dont stop some tages like: scriptalert(document.cookie)/script iframe src=http://eg.com/deface.htm for fix it u should write simple code for stopping iframe or script or ... http://www.PHP.com Lone Rider Knight
Bug in HC
In GOD We Trust Kachal667 Under9round Team (KuT) Hi, Here's my(LrK) new advisory about Hosting Controller. Hosting Controller - CSS vulnerabilities Found date : Pri8 Public Date: 02/11/2005 Summary --- Hosting Controller is an all-in-one administrative hosting tool for Windows. It automates a wide range of hosting tasks and provides control of each hosted site to the respective owners. Hosting Controller is now widely used by hosting providers and can be found at http://www.hostingcontroller.com. HostingController was tested. (Probably all prior versions) Vulnerability Impact: An attacker may be able to put him message or photo or .. not intended to be publically accessible and upload scripts to manipulate files and control administration of sites using the latest version of HostingController. Lone Rider Knight Details --- Vulnerability Hosting Controller has a security flaw which allows outside attackers to Put her message with css Sample scripts that allow browsing anywhere on the server: http://www.eg.com/admin/hosting/error.asp?error=salam! http://www.eg.com/admin/hosting/error.asp?error=IMG%20height=340%20src=http://eg.com/Deface/deface.jpg%20width=596; http://www.eg.com/hosting/error.asp?error=IMG%20height=340%20src=http://eg.com/Deface/deface.jpg%20width=596; The directory hc is an example of the path to the HostingController script on the sample domain. The actual hc directory name -- such as admin or hostingcontroller -- must be discovered for each eg.com and replaced in the above URL scripts. Lone Rider Knight
