vendor:
ReviewPost
by:
SecuriTeam
9,3
CVSS
HIGH
Cross Site Scripting, SQL Injection, Arbitrary File Upload
79, 89, 352
CWE
Product Name: ReviewPost
Affected Version From: <= 2.84
Affected Version To: <= 2.84
Patch Exists: YES
Related CWE: CVE-2005-0270, CVE-2005-0271, CVE-2005-0272
CPE: a:all_enthusiast:reviewpost
Metasploit:
N/A
Other Scripts:
N/A
Tags: N/A
CVSS Metrics: N/A
Nuclei References:
N/A
Nuclei Metadata: N/A
Platforms Tested: None
2005
ReviewPost Multiple Vulnerabilities
ReviewPost is prone to cross site scripting in several different scripts throughout the application. There are a couple of SQL Injection vulnerabilities in ReviewPost. Some are easy to exploit, others are not so easy. This issue can be very dangerous as it allows a user to upload php scripts and other files.
Mitigation:
Upgrade to the latest version of ReviewPost