vendor:
Elgg
by:
Aung Khant
7.5
CVSS
HIGH
XSS, SQL Injection
79 (XSS), 89 (SQL Injection)
CWE
Product Name: Elgg
Affected Version From: 1.7.10
Affected Version To: 1.7.10
Patch Exists: YES
Related CWE: N/A
CPE: elgg:elgg
Metasploit:
N/A
Other Scripts:
N/A
Tags: N/A
CVSS Metrics: N/A
Nuclei References:
N/A
Nuclei Metadata: N/A
Platforms Tested: N/A
2011
Exploit Title: Elgg 1.7.10 <= Multiple Vulnerabilities
XSS: A malicious user can inject a malicious script into the internalname parameter of the embed/media page. The script will be executed when the mouse is hovered over the page. SQL Injection: A malicious user can inject a malicious SQL query into the tag_names parameter of the search page.
Mitigation:
Input validation should be used to prevent XSS and SQL Injection attacks. Sanitize user input and escape special characters.
