Pay Per Minute Video Chat Script SQL Injection and Multiple Cross Site Scripting Vulnerabilities

Bugtraq ID:	40585
Class:	Input Validation Error
CVE:
Remote:	Yes
Local:	No
Published:	Jan 04 2010 12:00AM
Updated:	Jan 04 2010 12:00AM
Credit:	R3d-D3v!L
Vulnerable:	PayPerViewVideoSoftware Pay Per Minute Video Chat Script 2.1 PayPerViewVideoSoftware Pay Per Minute Video Chat Script 2.0
Not Vulnerable:

Pay Per Minute Video Chat Script SQL Injection and Multiple Cross Site Scripting Vulnerabilities

Pay Per Minute Video Chat Script is prone to an SQL-injection vulnerability and multiple cross-site scripting vulnerabilities because it fails to sufficiently sanitize user-supplied input.

Exploiting these vulnerabilities could allow an attacker to steal cookie-based authentication credentials, compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database.

Pay Per Minute Video Chat Script SQL Injection and Multiple Cross Site Scripting Vulnerabilities

Attackers can use a browser to exploit these issues.

The following example URIs are available:

• /data/vulnerabilities/exploits/40585.txt

Pay Per Minute Video Chat Script SQL Injection and Multiple Cross Site Scripting Vulnerabilities

Solution:
Currently we are not aware of any vendor-supplied patches. If you feel we are in error or if you are aware of more recent information, please mail us at: [email protected].

Pay Per Minute Video Chat Script SQL Injection and Multiple Cross Site Scripting Vulnerabilities

References:

• PayPerViewVideoSoftware HomePage (PayPerViewVideoSoftware)