Xstate Real Estate SQL Injection and Multiple Cross Site Scripting Vulnerabilities

Bugtraq ID:	42000
Class:	Input Validation Error
CVE:	CVE-2009-4477 CVE-2009-4478
Remote:	Yes
Local:	No
Published:	Sep 04 2009 12:00AM
Updated:	Sep 04 2009 12:00AM
Credit:	Moudi
Vulnerable:
Not Vulnerable:

Xstate Real Estate SQL Injection and Multiple Cross Site Scripting Vulnerabilities

Xstate Real Estate is prone to an SQL-injection vulnerability and multiple cross-site scripting vulnerabilities because it fails to sufficiently sanitize user-supplied data.

Exploiting these vulnerabilities could allow an attacker to steal cookie-based authentication credentials, compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database.

Xstate Real Estate 1.0 is vulnerable; other versions may also be affected.

Xstate Real Estate SQL Injection and Multiple Cross Site Scripting Vulnerabilities

Attackers can use a browser to exploit this issue.

Xstate Real Estate SQL Injection and Multiple Cross Site Scripting Vulnerabilities

Solution:
Currently we are not aware of any vendor-supplied patches for this issue. If you feel we are in error or are aware of more recent information, please mail us at: [email protected]

Xstate Real Estate SQL Injection and Multiple Cross Site Scripting Vulnerabilities

References:

• Xstate Homepage (Xstate)