vendor:
PhpVID Script
by:
3spi0n
8,8
CVSS
HIGH
SQL Injection, XSS, CRLF Injection
89, 79, 20
CWE
Product Name: PhpVID Script
Affected Version From: N/A
Affected Version To: N/A
Patch Exists: NO
Related CWE: N/A
CPE: N/A
Metasploit:
N/A
Other Scripts:
N/A
Tags: N/A
CVSS Metrics: N/A
Nuclei References:
N/A
Nuclei Metadata: N/A
Platforms Tested: N/A
2020
PhpVID Script, Multiple Vulnerabilities
The PhpVID Script is vulnerable to multiple vulnerabilities such as SQL Injection, XSS and CRLF Injection. The SQL Injection vulnerabilities can be exploited by passing malicious payloads in the 'cat' and 'n' parameters of the browse_videos.php, groups.php and members.php files. The XSS vulnerability can be exploited by passing malicious payloads in the 'cat', 'n' and 'query' parameters of the browse_videos.php, groups.php and search_results.php files. The CRLF Injection vulnerability can be exploited by passing malicious payloads in the 'query' parameter of the search_results.php file.
Mitigation:
The application should be configured to validate user input and filter out malicious payloads. The application should also be configured to use parameterized queries to prevent SQL Injection attacks.
