vendor:
CoolForum
by:
SecurityFocus
7.5
CVSS
HIGH
SQL Injection and Cross-Site Scripting
89, 79
CWE
Product Name: CoolForum
Affected Version From: N/A
Affected Version To: N/A
Patch Exists: N/A
Related CWE: N/A
CPE: N/A
Metasploit:
N/A
Other Scripts:
N/A
Tags: N/A
CVSS Metrics: N/A
Nuclei References:
N/A
Nuclei Metadata: N/A
Platforms Tested: N/A
2005
Multiple Remote Input Validation Vulnerabilities in CoolForum
Multiple remote input validation vulnerabilities affect CoolForum. These issues are due to a failure of the application to properly sanitize user-supplied input prior to using it to carry out critical functionality. Multiple SQL injection vulnerabilities have been reported and a cross-site scripting vulnerability is also reported. An attacker may leverage these issues to manipulate and view arbitrary database contents by exploiting the SQL injection issues, and to have arbitrary script code executed in the browser of an unsuspecting user by exploiting the cross-site scripting vulnerabilities.
Mitigation:
Input validation should be performed to ensure that untrusted data is not used to execute unintended commands or queries. All input data should be validated and filtered, and special characters should be escaped or removed.
