vendor:
GS Real Estate Portal US and International Module
by:
ZoRLu
6.4
CVSS
MEDIUM
SQL/BYPASS/RFU/XSS
89, 287, 264, 79
CWE
Product Name: GS Real Estate Portal US and International Module
Affected Version From: N/A
Affected Version To: N/A
Patch Exists: NO
Related CWE: N/A
CPE: N/A
Metasploit:
N/A
Other Scripts:
N/A
Tags: N/A
CVSS Metrics: N/A
Nuclei References:
N/A
Nuclei Metadata: N/A
Platforms Tested: N/A
2008
GS Real Estate Portal US and International Module
SQL Injection: An attacker can inject malicious SQL queries into the vulnerable parameter AgentID in the URL http://localhost/script/email.php?AgentID=[SQL]. Authentication Bypass: An attacker can bypass authentication by using username: [real_admin_or_user_name] ' or ' 1=1-- and password: ZoRLu. Remote File Upload: An attacker can upload a malicious file by logging into the application and editing their profile. XSS: An attacker can inject malicious JavaScript code into the vulnerable parameter ListingID in the URL http://localhost/script/email.php?AgentID=&ListingID="><script>alert()</script>
Mitigation:
Input validation should be done to prevent SQL injection, authentication bypass, and XSS attacks. Access control should be implemented to prevent remote file upload attacks.
