vendor:
Alibaba Clone
by:
Hamza 'MizoZ' N.
7,5
CVSS
HIGH
SQL Injection & XSS
89 (SQL Injection) & 79 (XSS)
CWE
Product Name: Alibaba Clone
Affected Version From: N/A
Affected Version To: N/A
Patch Exists: NO
Related CWE: N/A
CPE: N/A
Metasploit:
N/A
Other Scripts:
N/A
Tags: N/A
CVSS Metrics: N/A
Nuclei References:
N/A
Nuclei Metadata: N/A
Platforms Tested: N/A
2020
SQL Injection & XSS in ITechSctipts Alibaba Clone
SQL Injection vulnerability exists in the cat_sell.php file, when the cid parameter is supplied with a malicious payload. An attacker can inject arbitrary SQL queries to the application. XSS vulnerability exists in the gen_confirm.php file, when the errmsg parameter is supplied with a malicious payload. An attacker can inject arbitrary JavaScript code to the application.
Mitigation:
Input validation should be done to prevent SQL Injection and XSS attacks. Sanitize user input and escape output.
