vendor:
Science Fair In A Box
by:
L0rd CrusAd3r aka VSN
9,3
CVSS
HIGH
SQL Injection & XSS
89
CWE
Product Name: Science Fair In A Box
Affected Version From: 2.0.6
Affected Version To: 2.0.6
Patch Exists: YES
Related CWE: CVE-2010-2790
CPE: a:sfiab:science_fair_in_a_box
Metasploit:
N/A
Other Scripts:
N/A
Tags: N/A
CVSS Metrics: N/A
Nuclei References:
N/A
Nuclei Metadata: N/A
Platforms Tested: Windows, Linux, Mac
2010
Science Fair In A Box SQLi & XSS Vulnerability
SFIAB is vulnerable to SQL Injection and XSS attacks. The vulnerability is due to the lack of proper input validation and sanitization of user-supplied data. An attacker can exploit this vulnerability by sending malicious SQL queries to the vulnerable application. This can allow an attacker to gain access to sensitive information stored in the database, such as usernames, passwords, and other confidential data. Additionally, an attacker can also inject malicious JavaScript code into the application, which can be used to steal user credentials or perform other malicious activities.
Mitigation:
The application should be configured to use parameterized queries and input validation should be implemented to ensure that user-supplied data is properly sanitized. Additionally, the application should be configured to use a secure authentication mechanism, such as OAuth or OpenID.
