Classified Ultra is prone to an SQL-injection vulnerability and a cross-site scripting vulnerability because it fails to sufficiently sanitize user-supplied data. Exploiting these vulnerabilities could allow an attacker to steal cookie-based authentication credentials, compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database. An attacker can exploit the SQL-injection vulnerability by sending a specially crafted HTTP request to the vulnerable application, such as http://www.example.com/demos/classifiedultra/subclass.php?c=16'[SQLi HERE]. An attacker can exploit the cross-site scripting vulnerability by sending a specially crafted HTTP request to the vulnerable application, such as http://www.example.com/demos/classifiedultra/subclass.php?c=6&cname=Credit%20Cards[XSS HERE].