vendor:
Myrephp Business Directory
by:
d3b4g
8,8
CVSS
HIGH
SQL Injection, Cross Site Scripting
89, 79
CWE
Product Name: Myrephp Business Directory
Affected Version From: N/A
Affected Version To: N/A
Patch Exists: NO
Related CWE: N/A
CPE: N/A
Metasploit:
N/A
Other Scripts:
N/A
Tags: N/A
CVSS Metrics: N/A
Nuclei References:
N/A
Nuclei Metadata: N/A
Platforms Tested: Windows 7
2020
Myrephp Business Directory, Multiple Vulnerabilities
The vulnerability is present in the Myrephp Business Directory software. It allows an attacker to inject malicious SQL queries into the application by manipulating the 'cat' parameter of the 'links.php' page. It also allows an attacker to inject malicious JavaScript code into the application by manipulating the 'look' parameter of the 'search.php' page.
Mitigation:
The application should be configured to use parameterized queries and input validation should be implemented to prevent malicious code from being injected.
