EmbryoCore CMS SQL Injection and Multiple HTML Injection Vulnerabilities
BID:53016
Info
EmbryoCore CMS SQL Injection and Multiple HTML Injection Vulnerabilities
| Bugtraq ID: | 53016 |
| Class: | Input Validation Error |
| CVE: | |
| Remote: | Yes |
| Local: | No |
| Published: | Apr 16 2012 12:00AM |
| Updated: | Apr 16 2012 12:00AM |
| Credit: | Kevin J of the Vulnerability Research Laboratory |
| Vulnerable: |
EmbryoCore CMS EmbryoCore CMS 1.03 |
| Not Vulnerable: | |
Discussion
EmbryoCore CMS SQL Injection and Multiple HTML Injection Vulnerabilities
EmbryoCore CMS is prone to an SQL-injection vulnerability and multiple HTML-injection vulnerabilities because it fails to sufficiently sanitize user-supplied input data.
Exploiting these issues may allow an attacker to compromise the application, access or modify data, exploit vulnerabilities in the underlying database, execute HTML and script code in the context of the affected site, steal cookie-based authentication credentials, or control how the site is rendered to the user; other attacks are also possible.
EmbryoCore CMS 1.03 is vulnerable; other versions may also be affected.
EmbryoCore CMS is prone to an SQL-injection vulnerability and multiple HTML-injection vulnerabilities because it fails to sufficiently sanitize user-supplied input data.
Exploiting these issues may allow an attacker to compromise the application, access or modify data, exploit vulnerabilities in the underlying database, execute HTML and script code in the context of the affected site, steal cookie-based authentication credentials, or control how the site is rendered to the user; other attacks are also possible.
EmbryoCore CMS 1.03 is vulnerable; other versions may also be affected.
Exploit / POC
EmbryoCore CMS SQL Injection and Multiple HTML Injection Vulnerabilities
Attackers can exploit these issues with a browser.
Attackers can exploit these issues with a browser.
Solution / Fix
EmbryoCore CMS SQL Injection and Multiple HTML Injection Vulnerabilities
Solution:
Currently we are not aware of any vendor-supplied patches. If you feel we are in error or are aware of more recent information, please mail us at: [email protected].
Solution:
Currently we are not aware of any vendor-supplied patches. If you feel we are in error or are aware of more recent information, please mail us at: [email protected].
References
EmbryoCore CMS SQL Injection and Multiple HTML Injection Vulnerabilities
References:
References:
- EmbryoCore CMS Homepage (EmbryoCore)
- EmbryoCore CMS v1.03 - Multiple Web Vulnerabilities (EmbryoCore)