[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

Re: tikiwiki 1.9.5 mysql password disclosure & xss

To: bugtraq@xxxxxxxxxxxxxxxxx
Subject: Re: tikiwiki 1.9.5 mysql password disclosure & xss
From: drunken_chin@xxxxxxxxx
Date: 25 Nov 2006 00:05:54 -0000

Another method to trigger this same bug is to pass a value that's too long - 

tiki-wiki_rss.php?ver=-65535

can be negative or positive, the webapp pukes the same info. Also affects 
earlier versions (1.9.2 tested).

Prev by Date: Re: Re: "Which is more secure? Oracle vs. Microsoft" (is it a fair comparison?)
Next by Date: Re: "Which is more secure? Oracle vs. Microsoft" (is it a fair comparison?)
Previous by thread: Re: tikiwiki 1.9.5 mysql password disclosure & xss
Next by thread: Outpost Insufficient validation of 'SandBox' driver input buffer
Index(es):
- Date
- Thread