Xigla Software Multiple Scripts SQL Injection and Cross-Site Scripting Vulnerabilities
BID:29672
Info
Xigla Software Multiple Scripts SQL Injection and Cross-Site Scripting Vulnerabilities
| Bugtraq ID: | 29672 |
| Class: | Input Validation Error |
| CVE: |
CVE-2008-2756 |
| Remote: | Yes |
| Local: | No |
| Published: | Jun 11 2008 12:00AM |
| Updated: | May 07 2015 05:28PM |
| Credit: | AmnPardaz Security Research Team |
| Vulnerable: |
XIGLA SOFTWARE Absolute Poll Manager XE 0 XIGLA SOFTWARE Absolute News Manager XE 3.2 XIGLA SOFTWARE Absolute Live Support XE 5.1 XIGLA SOFTWARE Absolute Image Gallery XE 0 XIGLA SOFTWARE Absolute Form Processor XE 4.0 XIGLA SOFTWARE Absolute Control Panel XE 0 XIGLA SOFTWARE Absolute Banner Manager XE 0 |
| Not Vulnerable: | |
Discussion
Xigla Software Multiple Scripts SQL Injection and Cross-Site Scripting Vulnerabilities
Multiple Xigla Software products are prone to cross-site scripting vulnerabilities and SQL-injection vulnerabilities because the applications fail to sufficiently sanitize user-supplied input.
Exploiting these issues could allow an attacker to steal cookie-based authentication credentials, compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database.
These issues affect the following Xigla Software products:
Absolute Live Support XE 5.1
Absolute News Manager XE 3.2
Absolute Banner Manager XE
Absolute Form Processor XE 4.0
Absolute Image Gallery XE
Absolute Poll Manager XE
Absolute Control Panel XE
Multiple Xigla Software products are prone to cross-site scripting vulnerabilities and SQL-injection vulnerabilities because the applications fail to sufficiently sanitize user-supplied input.
Exploiting these issues could allow an attacker to steal cookie-based authentication credentials, compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database.
These issues affect the following Xigla Software products:
Absolute Live Support XE 5.1
Absolute News Manager XE 3.2
Absolute Banner Manager XE
Absolute Form Processor XE 4.0
Absolute Image Gallery XE
Absolute Poll Manager XE
Absolute Control Panel XE
Exploit / POC
Xigla Software Multiple Scripts SQL Injection and Cross-Site Scripting Vulnerabilities
An attacker can exploit these issues via a browser. To exploit a cross-site scripting vulnerability, the attacker must entice a victim to follow a malicious URI.
An attacker can exploit these issues via a browser. To exploit a cross-site scripting vulnerability, the attacker must entice a victim to follow a malicious URI.
Solution / Fix
Xigla Software Multiple Scripts SQL Injection and Cross-Site Scripting Vulnerabilities
Solution:
Currently we are not aware of any vendor-supplied patches. If you feel we are in error or if you are aware of more recent information, please mail us at: [email protected].
Solution:
Currently we are not aware of any vendor-supplied patches. If you feel we are in error or if you are aware of more recent information, please mail us at: [email protected].
References
Xigla Software Multiple Scripts SQL Injection and Cross-Site Scripting Vulnerabilities
References:
References:
- Vendor Homepage (XIGLA Software)
- Xigla Multiple Products - Multiple Vulnerabilities ([email protected])