vendor:
phpCommunity 2
by:
Salvatore "drosophila" Fresta
7.5
CVSS
HIGH
Multiple SQL Injection, Directory Traversal and Reflected XSS
89, 22, 79
CWE
Product Name: phpCommunity 2
Affected Version From: 2.1.2008
Affected Version To: 2.1.2008
Patch Exists: NO
Related CWE: N/A
CPE: 2.1.2008
Metasploit:
N/A
Other Scripts:
N/A
Tags: N/A
CVSS Metrics: N/A
Nuclei References:
N/A
Nuclei Metadata: N/A
Platforms Tested: N/A
2009
phpCommunity 2 Multiple SQL Injection, Directory Traversal and Reflected XSS
This web application presents several vulnerabilities which can be exploited to obtain reserved information. The Multiple SQL Injection vulnerability allows a guest to view username and password of a registered user. The Directory Traversal vulnerability allows a guest to read arbitrary files and directory on the web server. The Reflected XSS vulnerability allows a guest to inject malicious scripts into the web application.
Mitigation:
Ensure that the application is not vulnerable to SQL injection attacks by using parameterized queries. Ensure that the application is not vulnerable to directory traversal attacks by validating user input. Ensure that the application is not vulnerable to XSS attacks by validating user input.
