Multi-Vendor Shopping Malls SQL Injection and Cross Site Scripting Vulnerabilities

Bugtraq ID:	41731
Class:	Input Validation Error
CVE:
Remote:	Yes
Local:	No
Published:	Jul 06 2010 12:00AM
Updated:	Mar 19 2015 08:25AM
Credit:	bi0; RoAd_KiLlEr
Vulnerable:	Pre Projects Pre Multi-Vendor Shopping Malls 0
Not Vulnerable:

Multi-Vendor Shopping Malls SQL Injection and Cross Site Scripting Vulnerabilities

Pre Multi-Vendor Shopping Malls is prone to an SQL-injection vulnerability and a cross-site scripting vulnerability because it fails to sufficiently sanitize user-supplied data.

Exploiting these issues could allow an attacker to steal cookie-based authentication credentials, compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database.

Multi-Vendor Shopping Malls SQL Injection and Cross Site Scripting Vulnerabilities

Attackers can use a browser to exploit these issues.

Multi-Vendor Shopping Malls SQL Injection and Cross Site Scripting Vulnerabilities

Solution:
Currently we are not aware of any vendor-supplied patches. If you feel we are in error or if you are aware of more recent information, please mail us at: [email protected].

Multi-Vendor Shopping Malls SQL Injection and Cross Site Scripting Vulnerabilities

References:

• Vendor Homepage (Pre Projects)