vendor:
News Manager Lite
by:
SecurityFocus
7.5
CVSS
HIGH
SQL injection, cross-site scripting, and account hijacking attacks
89, 79, 613
CWE
Product Name: News Manager Lite
Affected Version From: 2.5
Affected Version To: 2.5
Patch Exists: YES
Related CWE: N/A
CPE: a:news_manager_lite:news_manager_lite
Metasploit:
N/A
Other Scripts:
N/A
Tags: N/A
CVSS Metrics: N/A
Nuclei References:
N/A
Nuclei Metadata: N/A
Platforms Tested: N/A
2002
Multiple vulnerabilities in News Manager Lite
Multiple vulnerabilities have been identified in the application that may allow an attacker to carry out SQL injection, cross-site scripting, and account hijacking attacks. The issues exist in the 'comment_add.asp', 'search.asp', 'category_news_headline.asp', 'more.asp', 'category_news.asp', and 'ews_sort.asp' scripts. Further more a cookie account hijacking issue was also discovered in the application that may allow a remote attacker to gain administrative access to application's administrative interface.
Mitigation:
Ensure that all user-supplied input is validated and filtered before being used in SQL queries, HTML output, or other operations. Ensure that all user-supplied input is properly escaped when being used in HTML output. Ensure that all user-supplied input is properly sanitized when being used in HTML output. Ensure that all user-supplied input is properly encoded when being used in HTML output. Ensure that all user-supplied input is properly validated when being used in HTML output. Ensure that all user-supplied input is properly filtered when being used in HTML output. Ensure that all user-supplied input is properly validated when being used in SQL queries. Ensure that all user-supplied input is properly filtered when being used in SQL queries. Ensure that all user-supplied input is properly sanitized when being used in SQL queries. Ensure that all user-supplied input is properly encoded when being used in SQL queries. Ensure that all user-supplied input is properly validated when being used in other operations. Ensure that all user-supplied input is properly filtered when being used in other operations. Ensure that all user-supplied input is properly sanitized when being used in other operations. Ensure that all user-supplied input is properly encoded when being used in other operations. Ensure that all user-supplied input is properly validated when being used in cookie values. Ensure that all user-supplied input is properly filtered when being used in cookie values. Ensure that all user-supplied input is properly sanitized when being used in cookie values. Ensure that all user-supplied input is properly encoded when being used in cookie values.
