Football Website Manager SQL Injection and HTML Injection Vulnerabilities

vendor:

Football Website Manager

by:

7.5

CVSS

HIGH

SQL Injection and HTML Injection

CWE

Product Name: Football Website Manager

Affected Version From: 1.1

Affected Version To: 1.1

Patch Exists: NO

Related CWE:

CPE:

Metasploit:

Other Scripts:

Platforms Tested:

Football Website Manager SQL Injection and HTML Injection Vulnerabilities

The Football Website Manager is prone to an SQL-injection vulnerability and multiple HTML-injection vulnerabilities because it fails to sufficiently sanitize user-supplied input. An attacker may leverage these issues to compromise the application, access or modify data, exploit latent vulnerabilities in the underlying database, or execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may allow the attacker to steal cookie-based authentication credentials, control how the site is viewed, and launch other attacks.

Mitigation:

Implement proper input sanitization and validation mechanisms to prevent SQL injection and HTML injection attacks. Use parameterized queries or prepared statements to handle user-supplied input securely. Regularly update the software to apply security patches and fixes provided by the vendor.

Source

Exploit-DB raw data:

source: https://www.securityfocus.com/bid/47593/info

Football Website Manager is prone to an SQL-injection vulnerability and multiple HTML-injection vulnerabilities because it fails to sufficiently sanitize user-supplied input.

An attacker may leverage these issues to compromise the application, access or modify data, exploit latent vulnerabilities in the underlying database, or execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may allow the attacker to steal cookie-based authentication credentials, control how the site is viewed, and launch other attacks.

Football Website Manager 1.1 is vulnerable; other versions may also be affected. 

http://www.example.com/profile.php?fileId=[SQL Injection]