Multiple PHP Scripts Now Products 'bios.php' Input Validation Vulnerability

Bugtraq ID:	44306
Class:	Input Validation Error
CVE:	CVE-2009-2884 CVE-2009-2885 CVE-2009-2886 CVE-2009-2887
Remote:	Yes
Local:	No
Published:	Jul 20 2009 12:00AM
Updated:	Jul 20 2009 12:00AM
Credit:	599eme Man
Vulnerable:	PHP Scripts Now World's Tallest Buildings 0 PHP Scripts Now President Bios 0
Not Vulnerable:

Multiple PHP Scripts Now Products 'bios.php' Input Validation Vulnerability

Multiple PHP Scripts Now products are prone to an input-validation vulnerability that can be exploited to conduct SQL-injection and cross-site scripting attacks.

Exploiting this vulnerability could allow an attacker to steal cookie-based authentication credentials, compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database.

The following products are affected:

PHP Scripts Now President Bios
PHP Scripts Now World's Tallest Buildings

Multiple PHP Scripts Now Products 'bios.php' Input Validation Vulnerability

An attacker can exploit this issues via a browser. To conduct a cross-site scripting attack, the attacker must entice a victim to follow a malicious URI.

The following example URIs are available:

• /data/vulnerabilities/exploits/44306.txt

Multiple PHP Scripts Now Products 'bios.php' Input Validation Vulnerability

Solution:
Currently we are not aware of any vendor-supplied patches. If you feel we are in error or if you are aware of more recent information, please mail us at: [email protected].

Multiple PHP Scripts Now Products 'bios.php' Input Validation Vulnerability

References:

• PHP Scripts Now Homepage (PHP Scripts Now)