vendor:
Sitedone Custom Edition
by:
d3v1l [Avram Marius]
8,8
CVSS
HIGH
SQL Injection & XSS
89
CWE
Product Name: Sitedone Custom Edition
Affected Version From: 2.0
Affected Version To: 2.0
Patch Exists: NO
Related CWE: N/A
CPE: a:sitedone:sitedone_custom_edition:2.0
Metasploit:
N/A
Other Scripts:
N/A
Tags: N/A
CVSS Metrics: N/A
Nuclei References:
N/A
Nuclei Metadata: N/A
Platforms Tested: N/A
2010
SiteDone Custom Edition 2.0 SQL Injection & XSS Vulnerability
A vulnerability was discovered in SiteDone Custom Edition 2.0 which allowed an attacker to inject malicious SQL queries and XSS payloads into the application. The vulnerability was discovered by d3v1l [Avram Marius] in March 2010 and was located in the detail.php page, where an attacker could inject a malicious SQL query or XSS payload via the articleId parameter. The malicious query or payload would then be executed by the application.
Mitigation:
The application should be configured to properly sanitize user input and prevent malicious SQL queries and XSS payloads from being executed.
