vendor:
Miniweb 2.0
by:
Moudi
8,8
CVSS
HIGH
Blind SQL Injection and XSS
89, 79
CWE
Product Name: Miniweb 2.0
Affected Version From: 2.0
Affected Version To: 2.0
Patch Exists: YES
Related CWE: N/A
CPE: a:miniweb:miniweb_2.0
Metasploit:
N/A
Other Scripts:
N/A
Tags: N/A
CVSS Metrics: N/A
Nuclei References:
N/A
Nuclei Metadata: N/A
Platforms Tested: N/A
2009
Miniweb 2.0 Module Survey Pro (bSQL/XSS) Multiple Remote Vulnerabilities
Miniweb 2.0 Module Survey Pro is vulnerable to Blind SQL Injection and XSS. An attacker can exploit this vulnerability by sending a malicious payload in the 'campaign_id' parameter of the 'index.php' page. For Blind SQL Injection, the attacker can send a payload like '1 and 1=2' to check if the query is true or false. For XSS, the attacker can send a malicious payload like '<script>alert(document.cookie)</script>' to execute the script in the victim's browser.
Mitigation:
Input validation should be done to prevent malicious payloads from being sent to the application. Also, the application should be updated to the latest version.
