AlGo MaS QuE HaCkinG

PHP Address Book 6.2.12 Multiple security vulnerabilities

Hoy Stefan Schurtz publica en exploit-db una serie de vulnerabilidades en el PHP adress book 6.2.12.

Las vulnerabilidades son SQLi y XSS.

SQL-Injection: http://[target]/addressbook/edit.php?id=[sql-injection] http://[target]/addressbook/vcard.php?id=[sql-injection] XSS: http://[target]/addressbook/preferences.php?from=XSS http://[target]/addressbook/index.php?group=XSS D0rks: inurl:addressbook/vcard.php?id= inurl:addressbook/edit.php?id=