PHPClassifieds.Info Multiple Input Validation Vulnerabilities

Bugtraq ID:	18713
Class:	Input Validation Error
CVE:
Remote:	Yes
Local:	No
Published:	Jun 28 2006 12:00AM
Updated:	Jun 29 2006 05:29PM
Credit:	luny is credited with the discovery of these vulnerabilities.
Vulnerable:	phpclassifieds.info phpclassifieds.info 0
Not Vulnerable:

PHPClassifieds.Info Multiple Input Validation Vulnerabilities

The 'phpclassifieds.info' product is prone to multiple input-validation vulnerabilities. The issues include HTML- and SQL-injection vulnerabilities. These issues are due to a failure in the application to properly sanitize user-supplied input.

Successful exploits of these vulnerabilities could allow an attacker to compromise the application, access or modify data, steal cookie-based authentication credentials, control how the site is rendered to the user, or exploit vulnerabilities in the underlying database implementation. Other attacks are also possible.

PHPClassifieds.Info Multiple Input Validation Vulnerabilities

These issues can be exploited through a web client.

The following proof-of-concept URI is available for the SQL-injection issue:

• /data/vulnerabilities/exploits/phpclassifieds-0628-sql-inj.html

PHPClassifieds.Info Multiple Input Validation Vulnerabilities

Solution:
Currently we are not aware of any vendor-supplied patches for this issue. If you feel we are in error or are aware of more recent information, please mail us at: [email protected]:[email protected].

PHPClassifieds.Info Multiple Input Validation Vulnerabilities

References:

• phpclassifieds.info Homepage (phpclassifieds.info)
  
• PHPClassifieds General (luny)