iScripts SocialWare Multiple Security Vulnerabilities
BID:41355
Info
iScripts SocialWare Multiple Security Vulnerabilities
| Bugtraq ID: | 41355 |
| Class: | Input Validation Error |
| CVE: | |
| Remote: | Yes |
| Local: | No |
| Published: | Jul 03 2010 12:00AM |
| Updated: | Jul 03 2010 12:00AM |
| Credit: | Salvatore Fresta aka Drosophila |
| Vulnerable: |
iScripts SocialWare 2.2 |
| Not Vulnerable: | |
Discussion
iScripts SocialWare Multiple Security Vulnerabilities
iScripts SocialWare is prone to multiple security vulnerabilities. These vulnerabilities include multiple HTML-injection vulnerabilities, multiple SQL-injection vulnerabilities, and multiple arbitrary-file-upload vulnerabilities.
An attacker can exploit these vulnerabilities to compromise the application, execute arbitrary script code in the browser of an unsuspecting user, steal cookie-based authentication credentials, control how the site is rendered to the user, exploit latent vulnerabilities in the underlying database, access or modify data, or upload and execute arbitrary script code in the context of the webserver process. Other attacks are also possible.
iScripts SocialWare 2.2 is vulnerable; other versions may be affected.
iScripts SocialWare is prone to multiple security vulnerabilities. These vulnerabilities include multiple HTML-injection vulnerabilities, multiple SQL-injection vulnerabilities, and multiple arbitrary-file-upload vulnerabilities.
An attacker can exploit these vulnerabilities to compromise the application, execute arbitrary script code in the browser of an unsuspecting user, steal cookie-based authentication credentials, control how the site is rendered to the user, exploit latent vulnerabilities in the underlying database, access or modify data, or upload and execute arbitrary script code in the context of the webserver process. Other attacks are also possible.
iScripts SocialWare 2.2 is vulnerable; other versions may be affected.
Exploit / POC
iScripts SocialWare Multiple Security Vulnerabilities
Attackers can exploit these issues via a browser.
The following proof of concept is available:
Attackers can exploit these issues via a browser.
The following proof of concept is available:
Solution / Fix
iScripts SocialWare Multiple Security Vulnerabilities
Solution:
Currently we are not aware of any vendor-supplied patches. If you feel we are in error or if you are aware of more recent information, please mail us at: [email protected].
Solution:
Currently we are not aware of any vendor-supplied patches. If you feel we are in error or if you are aware of more recent information, please mail us at: [email protected].
References
iScripts SocialWare Multiple Security Vulnerabilities
References:
References:
- iScripts SocialWare Homepage (iScripts)
- iScripts SocialWare 2.2.x Multiple Remote Vulnerability (Salvatore Fresta aka Drosophila)