vendor:
dotProject
by:
Unknown
7.5
CVSS
HIGH
SQL Injection, HTML Injection
89
CWE
Product Name: dotProject
Affected Version From: 2.1.2003
Affected Version To: Unknown
Patch Exists: NO
Related CWE:
CPE: a:dotProject:dotProject:2.1.3
Platforms Tested:
Unknown
dotProject Multiple SQL and HTML Injection Vulnerabilities
dotProject is prone to multiple SQL-injection and HTML-injection vulnerabilities because it fails to sufficiently sanitize user-supplied input. An attacker may leverage the HTML-injection issues to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may allow the attacker to steal cookie-based authentication credentials, control how the site is viewed, and launch other attacks. The attacker may exploit the SQL-injection issues to compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database.
Mitigation:
It is recommended to sanitize user-supplied input to prevent SQL and HTML injection vulnerabilities. Implementing proper input validation and using parameterized queries or prepared statements can help mitigate these vulnerabilities.