PluggedOut Nexus Search Script Input Validation Vulnerabilities
BID:15724
Info
PluggedOut Nexus Search Script Input Validation Vulnerabilities
| Bugtraq ID: | 15724 |
| Class: | Input Validation Error |
| CVE: | |
| Remote: | Yes |
| Local: | No |
| Published: | Dec 06 2005 12:00AM |
| Updated: | Dec 06 2005 12:00AM |
| Credit: | Discovery is credited to r0t. |
| Vulnerable: |
PluggedOut Nexus 0.1 |
| Not Vulnerable: | |
Discussion
PluggedOut Nexus Search Script Input Validation Vulnerabilities
PluggedOut Nexus is prone to multiple input validation vulnerabilities. These issues could permit HTML injection and SQL injection attacks.
In the case of the HTML injection vulnerabilities, these issues could let a remote attacker execute hostile HTML and script code in the browser session of a user of the affected site. This could permit attackers to steal cookie-based authentication credentials. Other attacks are also possible.
The SQL injection vulnerabilities could permit an attacker to influence the structure and logic of SQL queries made by the application. This could be exploited to compromise the application or gain unauthorized database access.
PluggedOut Nexus is prone to multiple input validation vulnerabilities. These issues could permit HTML injection and SQL injection attacks.
In the case of the HTML injection vulnerabilities, these issues could let a remote attacker execute hostile HTML and script code in the browser session of a user of the affected site. This could permit attackers to steal cookie-based authentication credentials. Other attacks are also possible.
The SQL injection vulnerabilities could permit an attacker to influence the structure and logic of SQL queries made by the application. This could be exploited to compromise the application or gain unauthorized database access.
Exploit / POC
PluggedOut Nexus Search Script Input Validation Vulnerabilities
There is no exploit required.
There is no exploit required.
Solution / Fix
PluggedOut Nexus Search Script Input Validation Vulnerabilities
Solution:
Currently we are not aware of any vendor-supplied patches for this issue. If you feel we are in error or are aware of more recent information, please mail us at: [email protected] <mailto:[email protected]>.
Solution:
Currently we are not aware of any vendor-supplied patches for this issue. If you feel we are in error or are aware of more recent information, please mail us at: [email protected] <mailto:[email protected]>.
References
PluggedOut Nexus Search Script Input Validation Vulnerabilities
References:
References:
- Nexus Homepage (PluggedOut)
- PluggedOut Nexus SQL&XSS vuln. (r0t)