Author of this article: SuperHei
Article nature: Original
Published date: 2005-08-14
Program description
OKPHP is a professional set of software developed by www.okphp.com Website management system, current products include: Okphp CMS, Okphp BBS, Okphp BLOG. Due to the lax filtering of variables and lax password authentication, SQL injection, XSS, and hidden variable post attacks are caused by cross-privilege operations.
Vulnerability Attack
1. SQl injection and xss
“Almost” exists in each variable, such as: forum.php
http://www.xxx.com/forum.php?action=view_forum&forum_id={sql}
http://cn.okphp.com/forum.php?action=view_forum&forum_id='xss
.......
2. Hidden variable post attack
When submitting request.php?action=user_modify to modify user information, there is no password authentication, which makes it easy to modify the user password and password through user_id. Information;
Exp:
