PHP Scripts Now Riddles Cross Site Scripting and SQL Injection Vulnerabilities

Bugtraq ID:	44309
Class:	Input Validation Error
CVE:	CVE-2009-2890 CVE-2009-2891
Remote:	Yes
Local:	No
Published:	Jul 20 2009 12:00AM
Updated:	Jul 20 2009 12:00AM
Credit:	Moudi
Vulnerable:	PHP Scripts Now Riddles 0
Not Vulnerable:

PHP Scripts Now Riddles Cross Site Scripting and SQL Injection Vulnerabilities

PHP Scripts Now Riddles is prone to an SQL-injection vulnerability and a cross-site scripting vulnerability because it fails to sufficiently sanitize user-supplied data.

Exploiting these issues could allow an attacker to steal cookie-based authentication credentials, compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database.

PHP Scripts Now Riddles Cross Site Scripting and SQL Injection Vulnerabilities

An attacker can exploit these issues through a browser. To exploit a cross-site scripting issue, the attacker must entice an unsuspecting victim to follow a malicious URI.

The following example URIs are available:

• /data/vulnerabilities/exploits/44309.txt

PHP Scripts Now Riddles Cross Site Scripting and SQL Injection Vulnerabilities

Solution:
Currently we are not aware of any vendor-supplied patches. If you feel we are in error or if you are aware of more recent information, please mail us at: [email protected].

PHP Scripts Now Riddles Cross Site Scripting and SQL Injection Vulnerabilities

References:

• PHP Scripts Now Homepage (PHP Scripts Now)