vendor:
DIY Web CMS
by:
p0pc0rn
8.8
CVSS
HIGH
SQL Injection and Cross-Site Scripting (XSS)
89 (SQL Injection) and 79 (XSS)
CWE
Product Name: DIY Web CMS
Affected Version From: N/A
Affected Version To: N/A
Patch Exists: NO
Related CWE: N/A
CPE: N/A
Metasploit:
N/A
Other Scripts:
N/A
Tags: N/A
CVSS Metrics: N/A
Nuclei References:
N/A
Nuclei Metadata: N/A
Platforms Tested: N/A
2011
SQL and XSS in DIY Web CMS
The DIY Web CMS is vulnerable to both SQL Injection and Cross-Site Scripting (XSS). An attacker can inject malicious SQL code into the 'menuid' parameter of the 'template.asp' page, as well as the 'id' parameter of the 'viewcatalog.asp' and 'xxx.asp' pages. Additionally, an attacker can inject malicious JavaScript code into the 'msg' parameter of the 'login.asp' page.
Mitigation:
Input validation should be used to prevent malicious code from being injected into the application. Additionally, the application should be configured to use parameterized queries to prevent SQL Injection.
