PHPShop CMS Multiple Cross Site Scripting and SQL Injection Vulnerabilities
BID:51130
Info
PHPShop CMS Multiple Cross Site Scripting and SQL Injection Vulnerabilities
| Bugtraq ID: | 51130 |
| Class: | Input Validation Error |
| CVE: | |
| Remote: | Yes |
| Local: | No |
| Published: | Dec 20 2011 12:00AM |
| Updated: | Dec 20 2011 12:00AM |
| Credit: | High-Tech Bridge SA Security Research Lab |
| Vulnerable: |
PHPShopCMS PHPShop CMS 3.4 |
| Not Vulnerable: |
PHPShopCMS PHPShop CMS 3.4.3.01 |
Discussion
PHPShop CMS Multiple Cross Site Scripting and SQL Injection Vulnerabilities
PHPShop CMS is prone to multiple cross-site scripting and SQL-injection vulnerabilities because it fails to properly sanitize user-supplied input before using it in dynamically generated content.
Exploiting these issues could allow an attacker to steal cookie-based authentication credentials, compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database.
PHPShop CMS 3.4 is vulnerable; prior versions may also be affected.
PHPShop CMS is prone to multiple cross-site scripting and SQL-injection vulnerabilities because it fails to properly sanitize user-supplied input before using it in dynamically generated content.
Exploiting these issues could allow an attacker to steal cookie-based authentication credentials, compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database.
PHPShop CMS 3.4 is vulnerable; prior versions may also be affected.
Exploit / POC
PHPShop CMS Multiple Cross Site Scripting and SQL Injection Vulnerabilities
Attackers can exploit these issues by enticing an unsuspecting victim to follow a malicious URI.
The following example URIs are available:
Attackers can exploit these issues by enticing an unsuspecting victim to follow a malicious URI.
The following example URIs are available:
Solution / Fix
PHPShop CMS Multiple Cross Site Scripting and SQL Injection Vulnerabilities
Solution:
Updates are available. Please see the references for more details.
Solution:
Updates are available. Please see the references for more details.
References
PHPShop CMS Multiple Cross Site Scripting and SQL Injection Vulnerabilities
References:
References:
- PHPShop CMS Free Security Vulnerabilities Notification (PHPShop CMS)
- PHPShop CMS Version History (PHPShop CMS)
- Multiple vulnerabilities in PHPShop CMS Free (High-Tech Bridge SA Security Research Lab)