by r0t,der4444,cembo,VietMafia

Friday, November 25, 2005

Fantastic News "category" SQL inj.

Fantastic News "category" SQL inj.
Vuln. dicovered by : r0t
Date: 25 nov. 2005
Vendor:www.fscripts.com
Product link:http://fscripts.com/free.php?id=1
affected version: 2.1.1 and prior


Product description:

Fantastic News is a very simple but powerful news management system. It contains an easy install script it gives you the ability to modify everything that the script displays since it uses templates. It has multiple user levels for news posters, ability to comment news, rating of news items, read more news option, WYSIWYG editor for news, uploading of files to news items, smilies and comment code for comments. It has the ability to generate XML feeds for a specified amount of news items. It has archive and search news support as well as a built in news tip system. It contains all these features but it is also very fast and uses minimal resources.


Vuln. Description:

Input passed to the "category" parameter in "news.php" isn't properly sanitised before being used in a SQL query. This can be exploited to manipulate SQL queries by injecting arbitrary SQL code.

example:
/news.php?action=news&category=[SQL]


Solution:
Edit the source code to ensure that input is properly sanitised.

6 Comments:

Anonymous scottaedwards told...

Congradulations on your blog! NOW, check this out, You can join a program that starts at only $7 then the costs go down. Down, Down, Down. It only takes 5 minutes to set up your international account!

To find out more visit: network marketing site. It successfully exposes FREE information and covers network marketing related stuff.

6:58 AM

 
Blogger Scott A. Edwards told...

Wow what a cool blog you have here! I am impressed. You really put a lot of time and effort into this. I wish I had your creative writing skills, progressive talent and self- discipline to produce a blog like you did. Your blog really does deserve an honest compliment. If you have some time, stop by my site. It deals with stuff like, click here: low cost multi level marketing and then feel free to e-mail me with your words of wisdom.

P.S. I'll sure put the word out about your site and I would appreciate any business you may send my. way... Later, Scott.

7:13 PM

 
Anonymous Scott Edwards told...

Congradulations on your blog! NOW, check this out, You can join a program that starts at only $7 then the costs go down. Down, Down, Down. It only takes 5 minutes to set up your international account!

To find out more visit: internet treasure site. It successfully exposes FREE information and covers internet treasure related stuff.

9:39 PM

 
Blogger Scott A. Edwards told...

The brand NEW! Safelist Autosubmission software XP - blasts your ads to 3.6 Million Safelist recipients at the click of one button.

Automatic-Mailer XP! - 50,000 hits guaranteed to your website every month! - Posts unlimited number of ads - Create unlimited number of profiles - Posts whenever you want! 24/7 - Schedule autosubmission when you are not at home - Sends Html & Text Advertisements.

Order today. Our Software also includes: - Autovalidation feature that automatically validates all your Safelists validation codes - mailbox cleaner feature that automatically keeps your mailboxes clean!

NOW That's an incredible Deal, isn't it? Get Your Astonishing Automatic - Mailer XP Software today!
Click here: AUTO-MAILER

2:00 AM

 
Anonymous Scott Arthur Edwards told...

The brand NEW! Safelist Autosubmission software XP - blasts your ads to 3.6 Million Safelist recipients at the click of one button.

Automatic-Mailer XP! - 50,000 hits guaranteed to your website every month! - Posts unlimited number of ads - Create unlimited number of profiles - Posts whenever you want! 24/7 - Schedule autosubmission when you are not at home - Sends Html & Text Advertisements.

Order today. Our Software also includes: - Autovalidation feature that automatically validates all your Safelists validation codes - mailbox cleaner feature that automatically keeps your mailboxes clean!

NOW That's an incredible Deal, isn't it? Get Your Astonishing Automatic - Mailer XP Software today!
Click here: AUTO-MAILER

3:31 PM

 
Anonymous Scott Arthur Edwards told...

Hello I am the traffic man, zip, zip, zip. make a new resolution to get a flood of traffic to your website this year. Let me show you how to get FREE traffic to your site. Yes I said FREE, FREE, FREE!!! Don't delay.

To find out more, visit my partners site. It successfully covers FREE information exposing FREE traffic and partners related stuff. Don't forget - FREE, FREE, FREE. You have nothing to lose!

10:58 PM

 

Post a Comment

<< Home

 
Copyright (c) 2006 Pridels Sec Crew