GS Real Estate Portal Multiple Input Validation Vulnerabilities
BID:32307
Info
GS Real Estate Portal Multiple Input Validation Vulnerabilities
| Bugtraq ID: | 32307 |
| Class: | Input Validation Error |
| CVE: | |
| Remote: | Yes |
| Local: | No |
| Published: | Nov 14 2008 12:00AM |
| Updated: | Nov 14 2008 12:00AM |
| Credit: | ZoRLu |
| Vulnerable: |
GulfSpider Real Estate Portal 0 |
| Not Vulnerable: | |
Discussion
GS Real Estate Portal Multiple Input Validation Vulnerabilities
GS Real Estate Portal is prone to multiple input-validation vulnerabilities, including:
- Multiple SQL-injection vulnerabilities
- A cross-site scripting vulnerability
- An arbitrary file upload vulnerability
An attacker can exploit these issues to execute arbitrary code in the context of the webserver process, steal cookie-based authentication credentials, control how the site is rendered to the user, compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database.
GS Real Estate Portal is prone to multiple input-validation vulnerabilities, including:
- Multiple SQL-injection vulnerabilities
- A cross-site scripting vulnerability
- An arbitrary file upload vulnerability
An attacker can exploit these issues to execute arbitrary code in the context of the webserver process, steal cookie-based authentication credentials, control how the site is rendered to the user, compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database.
Exploit / POC
GS Real Estate Portal Multiple Input Validation Vulnerabilities
Attackers can exploit these issues through a browser. To exploit the cross-site scripting vulnerabilities, an attacker must entice an unsuspecting victim to follow a malicious URI.
Attackers can exploit these issues through a browser. To exploit the cross-site scripting vulnerabilities, an attacker must entice an unsuspecting victim to follow a malicious URI.
Solution / Fix
GS Real Estate Portal Multiple Input Validation Vulnerabilities
Solution:
Currently we are not aware of any vendor-supplied patches. If you feel we are in error or if you are aware of more recent information, please mail us at: [email protected].
Solution:
Currently we are not aware of any vendor-supplied patches. If you feel we are in error or if you are aware of more recent information, please mail us at: [email protected].
References
GS Real Estate Portal Multiple Input Validation Vulnerabilities
References:
References:
- GS Real Estate Portal Project Page (GulfSpider)