vendor:
iWiccle
by:
SirGod
8,8
CVSS
HIGH
Local File Inclusion and SQL Injection
22, 89
CWE
Product Name: iWiccle
Affected Version From: 1.01
Affected Version To: 1.01
Patch Exists: NO
Related CWE: N/A
CPE: a:wiccle:iwiccle
Metasploit:
N/A
Other Scripts:
N/A
Tags: N/A
CVSS Metrics: N/A
Nuclei References:
N/A
Nuclei Metadata: N/A
Platforms Tested: N/A
2009
iWiccle 1.01 (LFI/SQL) Multiple Remote Vulnerabilities
iWiccle 1.01 is vulnerable to both Local File Inclusion and SQL Injection. An attacker can exploit these vulnerabilities by sending crafted requests to the application. For Local File Inclusion, an attacker can send a crafted request to the application with a malicious file path in the ‘module’ parameter. For SQL Injection, an attacker can send a crafted request to the application with a malicious SQL query in the ‘member_id’ parameter.
Mitigation:
To mitigate the Local File Inclusion vulnerability, the application should validate the user input and restrict the access to the application to only trusted users. To mitigate the SQL Injection vulnerability, the application should use parameterized queries and input validation.
