Schoolwires Academic Portal SQL Injection Vulnerability and Cross-Site Scripting Vulnerability

Bugtraq ID:	27903
Class:	Input Validation Error
CVE:	CVE-2008-0908
Remote:	Yes
Local:	No
Published:	Feb 20 2008 12:00AM
Updated:	May 07 2015 05:32PM
Credit:	Russ McRee and Holistic of infoSec.org are credited with the discovery of these vulnerabilities.
Vulnerable:	Schoolwires Academic Portal 0
Not Vulnerable:

Schoolwires Academic Portal SQL Injection Vulnerability and Cross-Site Scripting Vulnerability

Schoolwires Academic Portal is prone to a cross-site scripting vulnerability and an SQL-injection vulnerability because the application fails to sufficiently sanitize user-supplied input.

Exploiting these issues could allow an attacker to steal cookie-based authentication credentials, compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database.

Schoolwires Academic Portal SQL Injection Vulnerability and Cross-Site Scripting Vulnerability

An attacker can exploit these issues via a browser. To exploit a cross-site scripting vulnerability, the attacker must entice a victim to follow a malicious URI.

Schoolwires Academic Portal SQL Injection Vulnerability and Cross-Site Scripting Vulnerability

References:

• Schoolwires Academic Portal Homepage (Schoolwires)