Sticky Notes Multiple HTML Injection and SQL Injection Vulnerabilities

Bugtraq ID:	54256
Class:	Input Validation Error
CVE:	CVE-2012-3997 CVE-2012-3998
Remote:	Yes
Local:	No
Published:	Jun 20 2012 12:00AM
Updated:	Apr 13 2015 09:31PM
Credit:	Reported by the vendor
Vulnerable:	Sticky Notes Sticky Notes 0.2.01042012.1
Not Vulnerable:

Sticky Notes Multiple HTML Injection and SQL Injection Vulnerabilities

Sticky Notes is prone to multiple HTML-injection Vulnerabilities and an SQL-injection vulnerability because it fails to sufficiently sanitize user-supplied input data.

Exploiting these issues may allow an attacker to compromise the application, access or modify data, exploit vulnerabilities in the underlying database, execute HTML and script code in the context of the affected site, steal cookie-based authentication credentials, or to control how the site is rendered to the user; other attacks are also possible.

Sticky Notes Multiple HTML Injection and SQL Injection Vulnerabilities

Solution:
Updates are available. Please see the references for more information.

Sticky Notes Multiple HTML Injection and SQL Injection Vulnerabilities

References:

• Bug 810928 - Review Request: sticky-notes - Sticky notes is a free and open sour (Red Hat)
  
• GIT Commit (Sticky Notes)
  
• Sticky Notes Homepage (Sticky Notes)