Description - Multiple XSS and SQL Injection in RedCMS
Multiple Vulnerabilities found in RedCMS script.
- Exploit
- Available
- Solution
- Not available - check vendor's website
1. Multiple Cross-Site Scripting Vulnerabilities.
Vulnerable Script:register.php
Parameters email, location, website are not properly sanitized. This can be used to post arbitrary HTML or web script code.
2. Multiple SQL Injections.
Vulnerable scripts: </p><p>login.php</p><p>profile.php</p><p>register.php</p><p>...</p>
Variables $username(login.php), $password(login.php), $u(profile.php), $username(register.php), $password(register.php),... All user-defined variables are not properly sanitized before being used in SQL queries. This can be used to bypass authentication or make any SQL query by injecting arbitrary SQL code.
Condition: magic_quotes_gpc = off
Order Source Code Analysis made by eVuln team
Prevent attacks by source code testing of your site made by our team.The task will be done by experts in website security.