Theeta CMS SQL Injection and Multiple Cross Site Scripting Vulnerabilities

Bugtraq ID:	41988
Class:	Input Validation Error
CVE:
Remote:	Yes
Local:	No
Published:	Jul 26 2010 12:00AM
Updated:	Jul 26 2010 12:00AM
Credit:	High-Tech Bridge SA
Vulnerable:	MN Tech Solutions Theeta CMS 0
Not Vulnerable:

Theeta CMS SQL Injection and Multiple Cross Site Scripting Vulnerabilities

Theeta CMS is prone to an SQL-injection vulnerability and multiple cross-site scripting vulnerabilities because it fails to sufficiently sanitize user-supplied data.

Exploiting these vulnerabilities could allow an attacker to steal cookie-based authentication credentials, compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database.

Theeta CMS SQL Injection and Multiple Cross Site Scripting Vulnerabilities

Attackers can use a browser to exploit this issue.

The following example URIs are available:

• /data/vulnerabilities/exploits/41988.txt

Theeta CMS SQL Injection and Multiple Cross Site Scripting Vulnerabilities

Solution:
Currently we are not aware of any vendor-supplied patches for this issue. If you feel we are in error or are aware of more recent information, please mail us at: [email protected]

Theeta CMS SQL Injection and Multiple Cross Site Scripting Vulnerabilities

References:

• MN Tech Solutions Homepage (MN Tech Solutions )
  
• SQL injection vulnerability in Theeta CMS ([email protected])
  
• XSS vulnerability in Theeta CMS ([email protected])
  
• XSS vulnerability in Theeta CMS ([email protected])
  
• XSS vulnerability in Theeta CMS ([email protected])