TCExam Multiple Cross Site Scripting and SQL Injection Vulnerabilities

Bugtraq ID:	55513
Class:	Input Validation Error
CVE:	CVE-2012-4601 CVE-2012-4602
Remote:	Yes
Local:	No
Published:	Sep 12 2012 12:00AM
Updated:	Sep 12 2012 12:00AM
Credit:	High-Tech Bridge SA Security Research Lab
Vulnerable:
Not Vulnerable:

TCExam Multiple Cross Site Scripting and SQL Injection Vulnerabilities

TCExam is prone to multiple cross-site scripting and SQL-injection vulnerabilities because it fails to sufficiently sanitize user-supplied data.

Exploiting these issues could allow an attacker to steal cookie-based authentication credentials, compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database.

TCExam 11.3.008 is vulnerable; prior versions may also be affected.

TCExam Multiple Cross Site Scripting and SQL Injection Vulnerabilities

An attacker can exploit these issues through a browser. To exploit a cross-site scripting issue, the attacker must entice an unsuspecting victim to follow a malicious URI.

The following exploits are available:

• /data/vulnerabilities/exploits/55513.txt

TCExam Multiple Cross Site Scripting and SQL Injection Vulnerabilities

Solution:
Vendor updates are available. Please see the references for more information.

TCExam Multiple Cross Site Scripting and SQL Injection Vulnerabilities

References:

• TCExam Homepage (TCExam)
  
• Version 11.3.009 of TCExam (Geeknet)
  
• Multiple vulnerabilities in TCExam (High-Tech Bridge SA)