0x01 Description
0x02 XSS
0x03 SQL Injection
0x04 Vendor Notification
This is a PHP Volunteer Management software. Keep track of Volunteer
hours worked and location assignments. This system is built on
PHP/MySql.
---------------Vulnerability-------------------
The 'id' parameter on the get_hours.php page is vulnerable to XSS. No
authentication is needed. This is a reflective XSS vulnerability.
----------Exploit-----------------------------------
------------PoC---------------------------
---------------Vulnerability-------------------
The 'id' parameter on the get_hours.php page is also vulnerable to SQL
Injection. No authentication is needed.
----------Exploit-----------------------------------
------------PoC---------------------------
4/21/12 - Vendor Notified
4/24/12 - Vendor reponded, OK to Disclose