vendor:
phpDatingClub
by:
ThE g0bL!N
7,5
CVSS
HIGH
SQL/XSS Injection
89
CWE
Product Name: phpDatingClub
Affected Version From: 3.7
Affected Version To: 3.7
Patch Exists: NO
Related CWE: N/A
CPE: a:phpdatingclub:phpdatingclub:3.7
Metasploit:
N/A
Other Scripts:
N/A
Tags: N/A
CVSS Metrics: N/A
Nuclei References:
N/A
Nuclei Metadata: N/A
Platforms Tested: N/A
2009
phpDatingClub v 3.7(ansubdepartments_id) SQL/XSS Injection Vulnerability
An attacker can exploit this vulnerability by sending a malicious SQL query to the vulnerable parameter 'sform[day]' in the 'search.php' script. This can be exploited to manipulate SQL queries by injecting arbitrary SQL code. An attacker can also exploit this vulnerability by sending a malicious XSS payload to the vulnerable parameter 'page' in the 'website.php' script. This can be exploited to execute arbitrary HTML and script code in a user's browser session in context of an affected site.
Mitigation:
Input validation should be used to prevent SQL injection attacks. Additionally, the application should also encode all output sent to the user's browser.
