vendor:
Miniweb 2.0
by:
Moudi
8,8
CVSS
HIGH
Blind SQL Injection and XSS
89
CWE
Product Name: Miniweb 2.0
Affected Version From: 2.0
Affected Version To: 2.0
Patch Exists: Yes
Related CWE: N/A
CPE: a:miniweb:miniweb_2.0
Metasploit:
N/A
Other Scripts:
N/A
Tags: N/A
CVSS Metrics: N/A
Nuclei References:
N/A
Nuclei Metadata: N/A
Platforms Tested: N/A
2009
Miniweb 2.0 Module Publisher (bSQL/XSS) Multiple Remote Vulnerabilities
Miniweb 2.0 Module Publisher is vulnerable to Blind SQL Injection and XSS. An attacker can exploit this vulnerability by sending a malicious payload to the vulnerable parameter 'historymonth' in the URL. For Blind SQL Injection, the attacker can send a payload like 'historyyear=2009&historymonth=[BLIND]' and for XSS, the attacker can send a payload like 'historyyear=2009&historymonth=<script>alert('XSS')</script>'
Mitigation:
The vendor has released a patch to address this vulnerability. Users are advised to update to the latest version of the software.
