SKIP Unspecified SQL Injection and Cross Site Scripting Vulnerabilities

Bugtraq ID:	34898
Class:	Input Validation Error
CVE:	CVE-2009-1908
Remote:	Yes
Local:	No
Published:	May 11 2009 12:00AM
Updated:	Apr 13 2015 09:10PM
Credit:	Reported via JVN
Vulnerable:	SKIP SKIP 1.0.2
Not Vulnerable:	SKIP SKIP 1.0.3

SKIP Unspecified SQL Injection and Cross Site Scripting Vulnerabilities

SKIP is prone to an SQL-injection vulnerability and a cross-site scripting vulnerability because it fails to sufficiently sanitize user-supplied data.

Exploiting these issues could allow an attacker to steal cookie-based authentication credentials, compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database.

Versions prior to SKIP 1.0.3 are affected.

SKIP Unspecified SQL Injection and Cross Site Scripting Vulnerabilities

An attacker can exploit these issues via a browser. To exploit a cross-site scripting issue, the attacker must entice an unsuspecting victim to follow a malicious URI.

SKIP Unspecified SQL Injection and Cross Site Scripting Vulnerabilities

Solution:
The vendor has released fixes. Please see the references for details.

SKIP Unspecified SQL Injection and Cross Site Scripting Vulnerabilities

References:

• SKIP release notes (SKIP)
  
• JVN#03114223 (JVN)
  
• JVN#43233160 (JVN)