vendor:
UTStats
by:
LuM Member
8,8
CVSS
HIGH
XSS, SQL Injection & Full path disclosure
79, 89, 200
CWE
Product Name: UTStats
Affected Version From: All recent versions
Affected Version To: All recent versions
Patch Exists: NO
Related CWE: none
CPE: None
Metasploit:
N/A
Other Scripts:
N/A
Tags: N/A
CVSS Metrics: N/A
Nuclei References:
N/A
Nuclei Metadata: N/A
Platforms Tested: Windows 7 x64
2010
UTStats XSS, SQL Injection & Full path disclosure
The exploit allows for XSS, SQL Injection and Full Path Disclosure vulnerabilities in all recent versions of UTStats. XSS can be exploited by sending a malicious payload to pages/match_report.php?mid=, while SQL Injection can be exploited by sending a malicious payload to index.php?p=matchp&pid=' and Full Path Disclosure can be exploited by sending a malicious payload to pages/servers_info.php.
Mitigation:
Input validation should be used to prevent XSS and SQL Injection attacks. Full Path Disclosure should be prevented by removing the path information from error messages.
