Course MS Cross Site Scripting, SQL Injection and Local File Include Vulnerabilities
BID:46495
Info
Course MS Cross Site Scripting, SQL Injection and Local File Include Vulnerabilities
| Bugtraq ID: | 46495 |
| Class: | Input Validation Error |
| CVE: | |
| Remote: | Yes |
| Local: | No |
| Published: | Feb 22 2011 12:00AM |
| Updated: | Feb 22 2011 12:00AM |
| Credit: | AutoSec Tools |
| Vulnerable: |
Course Registration Management System Course Registration Management System 2.1 |
| Not Vulnerable: | |
Discussion
Course MS Cross Site Scripting, SQL Injection and Local File Include Vulnerabilities
Course Registration Management System is prone to multiple input-validation vulnerabilities, including:
1. Multiple cross-site scripting vulnerabilities
2. An SQL-injection vulnerability
3. A local file-include vulnerability
Exploiting these issues could allow an attacker to execute arbitrary script code and PHP code in the browser of an unsuspecting user in the context of the affected site, steal cookie-based authentication credentials, compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database.
Course Registration Management System 2.1 is vulnerable; other versions may also be affected.
Course Registration Management System is prone to multiple input-validation vulnerabilities, including:
1. Multiple cross-site scripting vulnerabilities
2. An SQL-injection vulnerability
3. A local file-include vulnerability
Exploiting these issues could allow an attacker to execute arbitrary script code and PHP code in the browser of an unsuspecting user in the context of the affected site, steal cookie-based authentication credentials, compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database.
Course Registration Management System 2.1 is vulnerable; other versions may also be affected.
Solution / Fix
Course MS Cross Site Scripting, SQL Injection and Local File Include Vulnerabilities
Solution:
Currently, we are not aware of any vendor-supplied patches. If you feel we are in error or are aware of more recent information, please mail us at: [email protected]
Solution:
Currently, we are not aware of any vendor-supplied patches. If you feel we are in error or are aware of more recent information, please mail us at: [email protected]