vendor:
Revista
by:
Sirdarckcat
7,5
CVSS
HIGH
Remote File Inclusion, SQLi, Credentials Bypass, XSS
89, 79, 264, 79
CWE
Product Name: Revista
Affected Version From: 1.1.2
Affected Version To: 1.1.2
Patch Exists: NO
Related CWE: N/A
CPE: a:php_org_mx:revista
Metasploit:
N/A
Other Scripts:
N/A
Tags: N/A
CVSS Metrics: N/A
Nuclei References:
N/A
Nuclei Metadata: N/A
Platforms Tested: N/A
2009
Revista 1.1.2
Revista is a simple spanish PHP magazine editor. It suffers from multiple vulnerabilities, including Remote File Inclusion, SQLi, Credentials Bypass, and XSS. Remote File Inclusion can be exploited by sending a malicious URL to the 'adodb' parameter. SQLi can be exploited by sending malicious SQL queries to the 'id_temas', 'cadena', 'id_autor', 'email', and 'id_articulo' parameters. Credentials Bypass can be exploited by sending a malicious URL to the 'ID_ADMIN' and 'SUPER_ADMIN' parameters. XSS can be exploited by sending malicious code to the 'cadena' and 'email' parameters.
Mitigation:
Input validation should be used to prevent malicious input from being sent to the application. Access control should be used to prevent unauthorized access to the application.
