I-Vision CMS Cross Site Scripting / SQL Injection

`  
============ { Ariko-Security - Advisory #2/5/2010 } =============  
  
XSS, SQL injection vulnerability in I-Vision CMS  
  
  
  
Vendor's Description of Software:  
# http://international-vision.com/inner.php?id=14&type=2  
  
Dork:  
# n/a  
  
Application Info:  
# Name: I-Vision CMS  
# ALL versions  
  
Vulnerability Info:  
# Type: XSS  
# Type: SQL injection Vulnerability  
# Risk: HIGH (BANK SYSTEMS)  
  
Fix:   
# N/A  
  
Time Table:  
# 02/05/2010 - Vendor notified.  
  
  
Input passed via the "type" parameter to inner.php is not properly   
  
sanitised before being used in a SQL query.  
  
Input passed to the "keys" parameter in search.php is not properly   
  
sanitised before being returned to the user.  
  
  
Solution:  
# Input validation of type parameter should be corrected.  
# Input validation of keys parameter should be corrected.  
  
  
Vulnerability:  
# http://[site]/inner.php?id=14&type=2[SQLi]  
# http://[site]/search.php?Value=0&pages=1&keys=[XSS]  
  
Credit:  
# Discoverd By: MG / Ariko-Security  
#Advisory:  
http://www.ariko-security.com/may2010/audyt_bezpieczenstwa_677.html  
# Website: http://Ariko-security.com  
# Contacts: support[-at-]ariko-security.com  
  
  
Ariko-Security  
[email protected]  
tel.: +48512946012 (Mo-Fr 10.00-20.00 CET)  
  
  
  
`