MiniTwitter SQL Injection and Cross Site Scripting Vulnerabilities

Bugtraq ID:	35088
Class:	Input Validation Error
CVE:
Remote:	Yes
Local:	No
Published:	May 25 2009 12:00AM
Updated:	May 25 2009 06:10PM
Credit:	YEnH4ckEr
Vulnerable:	BioScripts MiniTwitter 0.3 BioScripts MiniTwitter 0.2 Beta
Not Vulnerable:	BioScripts MiniTwitter 0.4

MiniTwitter SQL Injection and Cross Site Scripting Vulnerabilities

MiniTwitter is prone to an SQL-injection vulnerability and a cross-site scripting vulnerability because it fails to adequately sanitize user-supplied input.

Exploiting these issues could allow an attacker to steal cookie-based authentication credentials, compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database.

MiniTwitter 0.3 Beta is vulnerable; other versions may also be affected.

MiniTwitter SQL Injection and Cross Site Scripting Vulnerabilities

Attackers can exploit these issues via a browser. To exploit the cross-site scripting issue, an attacker must entice an unsuspecting user into visiting a malicious URI.

MiniTwitter SQL Injection and Cross Site Scripting Vulnerabilities

Solution:
The vendor has released an update. Please see the references for details.

MiniTwitter SQL Injection and Cross Site Scripting Vulnerabilities

References:

• MiniTwitter Project Page (BioScripts)
  
• Release Name: 0.4 (MiniTwitter)
  
• MULTIPLE REMOTE VULNERABILITIES --MiniTwitter<=v0.3-Beta--> ([email protected])