sNews Multiple Input Validation Vulnerabilities
BID:16647
Info
sNews Multiple Input Validation Vulnerabilities
| Bugtraq ID: | 16647 |
| Class: | Input Validation Error |
| CVE: | |
| Remote: | Yes |
| Local: | No |
| Published: | Feb 14 2006 12:00AM |
| Updated: | Feb 14 2006 12:00AM |
| Credit: | joffer and DrFrancky are credited with the discovery of these vulnerabilities. |
| Vulnerable: |
Solucija sNews 0 |
| Not Vulnerable: | |
Discussion
sNews Multiple Input Validation Vulnerabilities
sNews is prone to multiple input-validation vulnerabilities. These issues are due to a failure in the application to properly sanitize user-supplied input.
Successful exploitation of these vulnerabilities could allow an attacker to compromise the application, access or modify data, steal cookie-based authentication credentials, control how the site is rendered to the user, or exploit vulnerabilities in the underlying database implementation. Other attacks are possible as well.
sNews is prone to multiple input-validation vulnerabilities. These issues are due to a failure in the application to properly sanitize user-supplied input.
Successful exploitation of these vulnerabilities could allow an attacker to compromise the application, access or modify data, steal cookie-based authentication credentials, control how the site is rendered to the user, or exploit vulnerabilities in the underlying database implementation. Other attacks are possible as well.
Exploit / POC
sNews Multiple Input Validation Vulnerabilities
An exploit is not required.
Example URI have been provided:
http://www.example.com/index.php?category=1%20or%201=2
http://www.example.com/index.php?id=0%20or%201=2
post comment with <script>alert('XSS TEST by www.example.com');</script>
An exploit is not required.
Example URI have been provided:
http://www.example.com/index.php?category=1%20or%201=2
http://www.example.com/index.php?id=0%20or%201=2
post comment with <script>alert('XSS TEST by www.example.com');</script>
Solution / Fix
sNews Multiple Input Validation Vulnerabilities
Solution:
Currently we are not aware of any vendor-supplied patches for this issue. If you feel we are in error or are aware of more recent information, please mail us at: [email protected] <mailto:[email protected]>.
Solution:
Currently we are not aware of any vendor-supplied patches for this issue. If you feel we are in error or are aware of more recent information, please mail us at: [email protected] <mailto:[email protected]>.
References
sNews Multiple Input Validation Vulnerabilities
References:
References:
- sNews Web Site (Solucija)
- XSS bugs and SQL injection in sNews (Alexander Hristov