[SA17333] phpESP Unspecified Cross-Site Scripting and SQL Injection

TITLE: phpESP Unspecified Cross-Site Scripting and SQL Injection SECUNIA ADVISORY ID: SA17333 VERIFY ADVISORY: http://secunia.com/advisories/17333/ CRITICAL: Moderately critical IMPACT: Cross Site Scripting, Manipulation of data WHERE: From remote SOFTWARE: phpESP 1.x...

phpESP (php Easy Survey Package)

Product : phpESP php Easy Survey Package Version : 1.11 WebSite : http://acm.jhu.edu Problem : Access in dbase Description: ------------ In admin directory exist file phpEST.ini if we look this file we can see database dbpassword, dblogin, dbhost, dbname and other private info. phpESP.ini...