vendor:
PHP Affiliate Script
by:
Moudi
7,5
CVSS
HIGH
bSQL-XSS
79 (XSS), 89 (SQL Injection)
CWE
Product Name: PHP Affiliate Script
Affected Version From: v1.4
Affected Version To: v1.4
Patch Exists: NO
Related CWE: N/A
CPE: N/A
Metasploit:
N/A
Other Scripts:
N/A
Tags: N/A
CVSS Metrics: N/A
Nuclei References:
N/A
Nuclei Metadata: N/A
Platforms Tested: N/A
2009
AccessoriesMe PHP Affiliate Script v1.4 (bSQL-XSS) Multiple Remote Vulnerabilities
AccessoriesMe PHP Affiliate Script v1.4 is prone to multiple remote vulnerabilities, including a cross-site scripting vulnerability and a blind SQL injection vulnerability. An attacker can exploit these issues to execute arbitrary HTML and script code in the browser of an unsuspecting user in the context of the affected site, to steal cookie-based authentication credentials, to control how the site is rendered to the user, to access sensitive information, and to exploit vulnerabilities in the underlying database.
Mitigation:
Input validation should be used to prevent cross-site scripting attacks. Additionally, parameterized queries should be used to prevent SQL injection attacks.
