Maian Script World Multiple Scripts SQL Injection and Cross-Site Scripting Vulnerabilities
BID:29032
Info
Maian Script World Multiple Scripts SQL Injection and Cross-Site Scripting Vulnerabilities
| Bugtraq ID: | 29032 |
| Class: | Input Validation Error |
| CVE: |
CVE-2008-2200 |
| Remote: | Yes |
| Local: | No |
| Published: | May 03 2008 12:00AM |
| Updated: | May 07 2015 05:29PM |
| Credit: | Khashayar Fereidani |
| Vulnerable: |
Maian Script World Maian Weblog 4.0 Maian Script World Maian Support 1.3 Maian Script World Maian Search 1.1 Maian Script World Maian Recipe 1.2 Maian Script World Maian Music 1.1 Maian Script World Maian Links 3.1 Maian Script World Maian Guestbook 3.2 Maian Script World Maian Greetings 2.1 Maian Script World Maian Gallery 2.0 Maian Script World Maian Cart 1.1 |
| Not Vulnerable: | |
Discussion
Maian Script World Multiple Scripts SQL Injection and Cross-Site Scripting Vulnerabilities
Multiple Maian Script World products are prone to cross-site scripting vulnerabilities and SQL-injection vulnerabilities because the applications fail to sufficiently sanitize user-supplied input.
Exploiting these issues could allow an attacker to steal cookie-based authentication credentials, compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database.
These issues affect the following Maian Script World products:
Maian Cart 1.1
Maian Gallery 2.0
Maian Greeting 2.1
Maian Guestbook 3.2
Maian Links 3.1
Maian Music 1.1
Maian Recipe 1.2
Maian Search 1.1
Maian Support 1.3
Maian Weblog 4.0
Multiple Maian Script World products are prone to cross-site scripting vulnerabilities and SQL-injection vulnerabilities because the applications fail to sufficiently sanitize user-supplied input.
Exploiting these issues could allow an attacker to steal cookie-based authentication credentials, compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database.
These issues affect the following Maian Script World products:
Maian Cart 1.1
Maian Gallery 2.0
Maian Greeting 2.1
Maian Guestbook 3.2
Maian Links 3.1
Maian Music 1.1
Maian Recipe 1.2
Maian Search 1.1
Maian Support 1.3
Maian Weblog 4.0
Exploit / POC
Maian Script World Multiple Scripts SQL Injection and Cross-Site Scripting Vulnerabilities
An attacker can exploit these issues via a browser. To exploit a cross-site scripting vulnerability, the attacker must entice a victim to follow a malicious URI.
An attacker can exploit these issues via a browser. To exploit a cross-site scripting vulnerability, the attacker must entice a victim to follow a malicious URI.
Solution / Fix
Maian Script World Multiple Scripts SQL Injection and Cross-Site Scripting Vulnerabilities
Solution:
Currently we are not aware of any vendor-supplied patches. If you feel we are in error or if you are aware of more recent information, please mail us at: [email protected].
Solution:
Currently we are not aware of any vendor-supplied patches. If you feel we are in error or if you are aware of more recent information, please mail us at: [email protected].
References
Maian Script World Multiple Scripts SQL Injection and Cross-Site Scripting Vulnerabilities
References:
References:
- Maian Weblog Homepage (Maian Script World)
- Maian Cart v1.1 XSS Vulnerabilities ([email protected])
- Maian Gallery v2.0 XSS Vulnerability ([email protected])
- Maian Greeting v2.1 Multiple Vulnerabilities (XSS/SQL INJECTION) ([email protected])
- Maian Guestbook v3.2 XSS Vulnerabilities ([email protected])
- Maian Links v3.1 XSS Vulnerabilities ([email protected])
- Maian Music v1.1 Multiple Vulnerabilities (Xss/SQL Injection) ([email protected])
- Maian Recipe v1.2 Xss Vulnerabilities ([email protected])
- Maian Search v1.1 Multiple Vulnerabilities (XSS/SQL INJECTION) ([email protected])
- Maian Support v1.3 Xss Vulnerabilities ([email protected])
- Maian Weblog v4.0 XSS Vulnerabilities ([email protected])