phpMyRecipes Multiple Remote Security Vulnerabilities
BID:64494
Info
phpMyRecipes Multiple Remote Security Vulnerabilities
| Bugtraq ID: | 64494 |
| Class: | Unknown |
| CVE: | |
| Remote: | Yes |
| Local: | No |
| Published: | Dec 23 2013 12:00AM |
| Updated: | Dec 23 2013 12:00AM |
| Credit: | Rafay Baloch And Sikandar Ali |
| Vulnerable: | |
| Not Vulnerable: | |
Discussion
phpMyRecipes Multiple Remote Security Vulnerabilities
phpMyRecipes is prone to multiple SQL-injection vulnerabilities, cross-site request forgery vulnerabilities, cross-site scripting vulnerabilities, and HTML-injection vulnerabilities because it fails to sufficiently sanitize user-supplied input.
Successful exploits could allow an attacker to steal cookie-based authentication credentials, access or modify data, exploit latent vulnerabilities in the underlying database, execute HTML and script code in the context of the affected site, control how the site is rendered to the user, or perform certain unauthorized actions in the context of the affected application; other attacks are also possible.
phpMyRecipes is prone to multiple SQL-injection vulnerabilities, cross-site request forgery vulnerabilities, cross-site scripting vulnerabilities, and HTML-injection vulnerabilities because it fails to sufficiently sanitize user-supplied input.
Successful exploits could allow an attacker to steal cookie-based authentication credentials, access or modify data, exploit latent vulnerabilities in the underlying database, execute HTML and script code in the context of the affected site, control how the site is rendered to the user, or perform certain unauthorized actions in the context of the affected application; other attacks are also possible.
Exploit / POC
phpMyRecipes Multiple Remote Security Vulnerabilities
An attacker can exploit these issues using a web browser. The attacker must trick a victim into following a malicious URI to exploit cross-site scripting and cross-site request forgery issues.
An attacker can exploit these issues using a web browser. The attacker must trick a victim into following a malicious URI to exploit cross-site scripting and cross-site request forgery issues.
Solution / Fix
phpMyRecipes Multiple Remote Security Vulnerabilities
Solution:
Currently, we are not aware of any vendor-supplied patches. If you feel we are in error or if you are aware of more recent information, please mail us at: [email protected].
Solution:
Currently, we are not aware of any vendor-supplied patches. If you feel we are in error or if you are aware of more recent information, please mail us at: [email protected].
References
phpMyRecipes Multiple Remote Security Vulnerabilities
References:
References: