phpSkelSite Multiple Input Validation Vulnerabilities
BID:33092
Info
phpSkelSite Multiple Input Validation Vulnerabilities
| Bugtraq ID: | 33092 |
| Class: | Input Validation Error |
| CVE: | |
| Remote: | Yes |
| Local: | No |
| Published: | Jan 03 2009 12:00AM |
| Updated: | Jan 05 2009 05:52PM |
| Credit: | ahmadbady |
| Vulnerable: |
Ap.Muthu phpSkelSite 1.4 |
| Not Vulnerable: | |
Discussion
phpSkelSite Multiple Input Validation Vulnerabilities
phpSkelSite is prone to multiple input-validation vulnerabilities:
- A remote file-include vulnerability
- A local file-include vulnerability
- A cross-site scripting vulnerability
An attacker can exploit these issues to execute malicious script code and PHP code in the context of the webserver process, compromise the affected application, and steal cookie-based authentication credentials. Other attacks are also possible.
phpSkelSite 1.4 is vulnerable; other versions may also be affected.
phpSkelSite is prone to multiple input-validation vulnerabilities:
- A remote file-include vulnerability
- A local file-include vulnerability
- A cross-site scripting vulnerability
An attacker can exploit these issues to execute malicious script code and PHP code in the context of the webserver process, compromise the affected application, and steal cookie-based authentication credentials. Other attacks are also possible.
phpSkelSite 1.4 is vulnerable; other versions may also be affected.
Exploit / POC
phpSkelSite Multiple Input Validation Vulnerabilities
Attackers can exploit these issues via a browser.
The following example URIs are available:
Attackers can exploit these issues via a browser.
The following example URIs are available:
Solution / Fix
phpSkelSite Multiple Input Validation Vulnerabilities
Solution:
Currently we are not aware of any vendor-supplied patches. If you feel we are in error or if you are aware of more recent information, please mail us at: [email protected].
Solution:
Currently we are not aware of any vendor-supplied patches. If you feel we are in error or if you are aware of more recent information, please mail us at: [email protected].