vendor:
CMS
by:
NoNameMT
7.5
CVSS
HIGH
SQL Injection
89
CWE
Product Name: CMS
Affected Version From: N/A
Affected Version To: N/A
Patch Exists: NO
Related CWE: N/A
CPE: N/A
Metasploit:
N/A
Other Scripts:
N/A
Tags: N/A
CVSS Metrics: N/A
Nuclei References:
N/A
Nuclei Metadata: N/A
Platforms Tested: Windows 7
2011
First Escort Marketing CMS Multiple SQL Injection Vulnerabilities
Multiple SQL Injection vulnerabilities exist in First Escort Marketing CMS, which could allow an attacker to execute arbitrary SQL commands on the underlying database. The vulnerabilities exist in the banner.php, escort-profile.php, write_review.php, booking-form.php, and gallery_escorts.php scripts, when user-supplied input is not properly sanitized before being used in a SQL query. An attacker can exploit these vulnerabilities by sending a maliciously crafted HTTP request to the vulnerable scripts.
Mitigation:
Input validation should be used to prevent SQL injection attacks. All user-supplied input should be validated and filtered before being used in a SQL query. Additionally, parameterized queries should be used to prevent SQL injection attacks.
