vendor:
Family Connections
by:
Salvatore Fresta aka Drosophila
7.5
CVSS
HIGH
Multiple Blind SQL Injection, Multiple Arbitrary File Upload, Local File Inclusion
89,434,22
CWE
Product Name: Family Connections
Affected Version From: <= 2.1.3
Affected Version To: 2.1.2004
Patch Exists: YES
Related CWE: N/A
CPE: a:family_connections:family_connections
Metasploit:
N/A
Other Scripts:
N/A
Tags: N/A
CVSS Metrics: N/A
Nuclei References:
N/A
Nuclei Metadata: N/A
Platforms Tested: N/A
2009
Family Connections <= 2.1.3 Multiple Remote Vulnerabilities
Many fields are not properly sanitised and some checks can be bypassed. All fields that were tested are vulnerable to Blind SQL Injection. An attacker may try to exploit this vulnerability using the full path disclosure released by the MySQL error to write a file into the remote file system, using as destination path the gallery directories, where the permissions must be setted to 777. When we want to write a module to upload a file, we must check the file extension. The application doesn't check the file extension, so an attacker can upload a malicious file with a double extension like .php.jpg. The application also doesn't check the file extension, so an attacker can upload a malicious file with a double extension like .php.jpg.
Mitigation:
The vendor released a new version (2.1.4) that fixes these vulnerabilities.
