vendor:
Xavier - PHP Login Script & User Management Admin Panel
by:
Vulnerability Laboratory Core Research Team
5,3
CVSS
MEDIUM
SQL Injection
89
CWE
Product Name: Xavier - PHP Login Script & User Management Admin Panel
Affected Version From: 2.4
Affected Version To: 2.4
Patch Exists: NO
Related CWE: N/A
CPE: a:siggles:xavier
Metasploit:
N/A
Other Scripts:
N/A
Tags: N/A
CVSS Metrics: N/A
Nuclei References:
N/A
Nuclei Metadata: N/A
Platforms Tested: Web-Application
2017
Xavier v2.4 PHP MP – SQL Injection Web Vulnerabilities
Multiple sql-injection vulnerabilities has been discovered in the Xavier PHP Login Script & User Management Admin Panel web-application. The issue allows remote attackers to inject own maliciou sql commands to compromise the web-application or dbms. The sql-injection web vulnerability is located in the `username` and `password` value of the `/login.php` file. Remote attackers are able to inject own sql commands to compromise the web-application or dbms.
Mitigation:
Input validation and sanitization should be used to prevent SQL injection attacks.