ID de Prueba:	1.3.6.1.4.1.25623.1.0.802243
Categoría:	Web application abuses
Título:	Snitz Forums 2000 'members.asp' SQL Injection and Cross Site Scripting Vulnerabilities
Resumen:	Snitz is prone to SQL injection and cross site scripting vulnerabilities.
Descripción:	Summary: Snitz is prone to SQL injection and cross site scripting vulnerabilities. Vulnerability Insight: - Input passed to the 'M_NAME' parameter in members.asp is not properly sanitised before being returned to the user. This can be exploited to execute arbitrary HTML and script code in a user's browser session in context of an affected site. - Input passed to the 'M_NAME' parameter in members.asp is not properly sanitised before being used in SQL queries. This can be exploited to manipulate SQL queries by injecting arbitrary SQL code. Vulnerability Impact: Successful exploitation could allow an attacker to steal cookie-based authentication credentials, compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database. Affected Software/OS: Snitz Forums 2000 version 3.4.07. Solution: Apply the patch from the referenced advisory. CVSS Score: 7.5 CVSS Vector: AV:N/AC:L/Au:N/C:P/I:P/A:P
Referencia Cruzada:	Common Vulnerability Exposure (CVE) ID: CVE-2010-4826 BugTraq ID: 45381 http://www.securityfocus.com/bid/45381 http://osvdb.org/69794 http://secunia.com/advisories/42308 Common Vulnerability Exposure (CVE) ID: CVE-2010-4827 http://osvdb.org/69793
Copyright	Copyright (C) 2011 Greenbone AG

Esta es sólo una de 146377 pruebas de vulnerabilidad en nuestra serie de pruebas. Encuentre más sobre cómo ejecutar una auditoría de seguridad completa. Para ejecutar una prueba gratuita de esta vulnerabilidad contra su sistema, regístrese ahora.