vendor:
meBiblio
by:
CWH Underground
8.8
CVSS
HIGH
SQL Injection/ Arbitrary File Upload/ XSS
89, 95, 79
CWE
Product Name: meBiblio
Affected Version From: 2000.4.7
Affected Version To: 2000.4.7
Patch Exists: NO
Related CWE: N/A
CPE: a:mebiblio:mebiblio:0.4.7
Metasploit:
N/A
Other Scripts:
N/A
Tags: N/A
CVSS Metrics: N/A
Nuclei References:
N/A
Nuclei Metadata: N/A
Platforms Tested: N/A
2008
meBiblio 0.4.7 Remote SQL Injection/ Arbitrary File Upload Exploit / XSS Vulnerability
meBiblio 0.4.7 is vulnerable to SQL Injection, Arbitrary File Upload and XSS. An attacker can exploit this vulnerability by sending a malicious SQL query to the vulnerable application. An attacker can also upload a malicious file to the vulnerable application and execute it. An attacker can also inject malicious JavaScript code into the vulnerable application.
Mitigation:
Input validation should be used to prevent SQL Injection, Arbitrary File Upload and XSS attacks. The application should also be configured to only allow trusted users to upload files.
