|
PHPAccounts vuln.
###############################################
Vuln. discovered by : r0t
Date: 21 June 2007
vendor:http://phpaccounts.com/
orginal advisory:
http://pridels-team.blogspot.com/2007/06/phpaccounts-vuln.html
affected versions: PHPAccounts 0.5
other versions also can be affected.
###############################################
1.Local file inclussion
PHPAccounts contains a flaw that allows a Local file inclusion
attacks.Inputpassed to the "page" parameter in "
index.php" isn't properly verified, before it is used to include files. This
can be exploited to include arbitrary files from local resources.
2. SQL Injection
PHPAccounts contains a flaw that allows a remote sql injection
attacks.Inputpassed to the
"Outgoing_Type_ID","Outgoing_ID","Project_ID",
"Client_ID","Invoice_ID","Vendor_ID"
parameter in "index.php" isn't properly sanitised before being used in a SQL
query.
This can be exploited to manipulate SQL queries by injecting arbitrary SQL
code.
###############################################
Solution:
Edit the source code to ensure that input is properly sanitised.
###############################################
|
