Ethical Hacking

Learn to find vulnerabilities before the bad guys do! Gain real world hands on hacking experience in our state of the art hacking lab. Course designed and taught by expert instructors with years of penetration testing experience. 12 student maximum in every class. Certification attempt included in every package.
Computer Forensics Training at InfoSec Institute

Gain the in-demand skills of a certified computer examiner, learn to recover trace data left behind by fraud, theft, and cybercrime perpetrators. Discover the source of computer crime and abuse at your organization so that it never happens again. All of our class sizes are guaranteed to be 12 students or less to facilitate one-on-one interaction with one of our expert instructors.




Network Security Bugtraq
[Top] [All Lists]
<prev [Date] next>
[Advanced]
 <prev [Thread] next>

Re: Vulnerability kali's tagboard

from [security curmudgeon] Network Security [Permanent Link]
Subject: Re: Vulnerability kali's tagboard
Date: Thu, 28 Apr 2005 03:47:35 -0400 (EDT) 

For reference, Kali's tagboard can be found at:
http://www.xentrik.net/php/tagboard.php

: There are some bugs in the kali's tagboard, you can access to the admin 
: system without password!, you can put iframes, scripts... But the most 
: vulnerabilitie is in the ban ip's, you can put this script: " <? 
: system($cmd) ?> " and execute commands in the server with this url: 
: Example: http://web.com/tag/admin/banned.php?&cmd=command.


From the readme.txt:


I suggest you password protect this directory with .htaccess, like so:

******************************************
* Example .htaccess File
******************************************
AuthUserFile /home/username/public_html/tagboard/admin/.htpasswd
AuthGroupFile /dev/null
AuthName "Tagboard Admin Area"
AuthType Basic

<Limit GET POST>
require valid-user
</Limit>
******************************************
To learn more about password protection with .htaccess, go to
http://www.xentrik.net/htaccess/password.php
[More with this subject...]




<Prev in Thread] Current Thread [Next in Thread>
Previous by Date:  RE: Capital One's website inadvertently assists phishing, Rager, Anton (Anton)
Next by Date:  phpBB Notes Mod SQL Injection Vulnerability, GulfTech Security Research
Previous by Thread:  Re: Vulnerability kali's tagboard, Jason Dodson
Next by Thread:  Re: Vulnerability kali's tagboard, Jesus
Indexes:  [Date] [Thread] [Top] [All Lists]