PHP Topsites Multiple Vulnerabilities
An HTML injection vulnerability has been discovered in PHP TopSites. The issue occurs due to insufficient sanitization of user-supplied data. By injecting HTML code into the <body> tag of the description page, when submitting website, it may be possible to cause an administrator to edit or delete database entries. This issue will occur when an unsuspecting administrator loads the submitted description. This vulnerability also affects the 'edit.php' script. A vulnerability has been discovered in PHP TopSites. Due to invalid sanitization of user-supplied input by the 'help.php' script, it may be possible for an attacker to steal another users cookie information or other sensitive data. This issue can be exploited by constructing a malicious URL containing embedded script code as a 'help.php' parameter. When an unsuspecting user follows the link sensitive information, such as cookie-based authentication credentials may be obtained by the attacker. A weakness has been discovered in PHP TopSites. It has been reported that user's passwords are stored in plaintext and thus are visible to TopSites administrators. This poses a security risk as TopSite script users may use the same passwords on other systems. A vulnerability has been discovered in PHP TopSites. Due to insufficient sanitization of user-supplied data, it may be possible for an attacker to inject arbitrary SQL code into the 'edit.php' script. This issue can be exploited by constructing a malicious URL containing embedded SQL code as a 'edit.php' parameter. When an unsuspecting user follows the link, the SQL code may be executed in the context of the vulnerable script.
