vendor:
MKPortal
by:
SecurityFocus
7.5
CVSS
HIGH
SQL-injection, HTML-injection, cross-site scripting, arbitrary-file-upload, and insecure-temporary-file-creation vulnerabilities
89, 79, 79, 264, 693
CWE
Product Name: MKPortal
Affected Version From: 1.2.2001
Affected Version To: 1.2.2001
Patch Exists: NO
Related CWE: N/A
CPE: mkportal
Metasploit:
N/A
Other Scripts:
N/A
Tags: N/A
CVSS Metrics: N/A
Nuclei References:
N/A
Nuclei Metadata: N/A
Platforms Tested: N/A
2008
MKPortal Multiple Security Vulnerabilities
Attackers can exploit these issues to execute arbitrary script code in the context of the webserver, compromise the application, steal cookie-based authentication credentials from legitimate users of the site, modify the way the site is rendered, access or modify data, or exploit latent vulnerabilities in the underlying database. Other attacks may also be possible.
Mitigation:
Ensure that all user-supplied input is validated and filtered before being used in the application. Ensure that the application is not vulnerable to SQL injection attacks. Ensure that the application is not vulnerable to HTML injection attacks. Ensure that the application is not vulnerable to cross-site scripting attacks. Ensure that the application is not vulnerable to arbitrary file upload attacks. Ensure that the application is not vulnerable to insecure temporary file creation attacks.
