Sosci Survey – Multiple Vulnerabilities

• Exploit Database
• 9 阅读

• 作者： T. Lazauninkas
  日期： 2013-04-17
• 类别：

  • webapps
  平台：

  • php
• 来源：https://www.exploit-db.com/exploits/38478/

• source: https://www.securityfocus.com/bid/59278/info
  
  Sosci Survey is prone to following security vulnerabilities:
  
  1. An unauthorized-access vulnerability
  2. Multiple cross-site scripting vulnerabilities
  3. Multiple HTML-injection vulnerabilities
  4. A PHP code-execution vulnerability
  
  Successful exploits may allow an attacker to gain unauthorized access to the affected application, allow attacker-supplied HTML and script code to run in the context of the affected browser, allow the attacker to steal cookie-based authentication credentials, control how the site is rendered to the user, or inject and execute arbitrary malicious PHP code in the context of the web server process. 
  
  https://www.example.com/admin/index.php?o=account&a=message.reply&id=[msg_id]
  https://www.example.com/admin/index.php?o=panel&a=receiver.edit&id=<script>alert(document.cookie)</script>