ID de Prueba:	1.3.6.1.4.1.25623.1.0.802970
Categoría:	Web application abuses
Título:	OSClass < 2.3.5 Multiple Vulnerabilities - Active Check
Resumen:	OSClass is prone to multiple cross-site scripting (XSS) and SQL; injection (SQLi) vulnerabilities.
Descripción:	Summary: OSClass is prone to multiple cross-site scripting (XSS) and SQL injection (SQLi) vulnerabilities. Vulnerability Insight: The following vulnerabilities exist: - Input passed via the 'sCategory' GET parameter to /index.php is not properly sanitised before being used in SQL query. - Input passed via the 'sCity', 'sPattern', 'sPriceMax', 'sPriceMin' GET parameters to /index.php is not properly sanitised before being returned to the user. - Input passed via the 'id' GET parameter in edit_category_post and enable_category action is not properly sanitised before being used in SQL query. - Input passed via the 'id' GET parameter in enable_category action to index.php is not properly sanitised before being returned to the user. Vulnerability Impact: Successful exploitation will allow attackers to execute arbitrary web script or HTML in a user's browser session in the context of an affected site and manipulate SQL queries by injecting arbitrary SQL code. Affected Software/OS: OSClass prior to version 2.3.5. Solution: Update to version 2.3.5 or later. CVSS Score: 7.5 CVSS Vector: AV:N/AC:L/Au:N/C:P/I:P/A:P
Referencia Cruzada:	Common Vulnerability Exposure (CVE) ID: CVE-2012-0973 BugTraq ID: 51662 http://www.securityfocus.com/bid/51662 Bugtraq: 20120125 Multiple vulnerabilities in OSclass (Google Search) http://archives.neohapsis.com/archives/bugtraq/2012-01/0157.html https://www.htbridge.ch/advisory/multiple_vulnerabilities_in_osclass.html http://secunia.com/advisories/47697 Common Vulnerability Exposure (CVE) ID: CVE-2012-0974 Common Vulnerability Exposure (CVE) ID: CVE-2012-5162 http://www.codseq.it/advisories/multiple_vulnerabilities_in_osclass XForce ISS Database: osclass-id-sql-injection(78964) https://exchange.xforce.ibmcloud.com/vulnerabilities/78964 Common Vulnerability Exposure (CVE) ID: CVE-2012-5163 XForce ISS Database: osclass-index-ajax-xss(78962) https://exchange.xforce.ibmcloud.com/vulnerabilities/78962
Copyright	Copyright (C) 2012 Greenbone AG

Esta es sólo una de 146377 pruebas de vulnerabilidad en nuestra serie de pruebas. Encuentre más sobre cómo ejecutar una auditoría de seguridad completa. Para ejecutar una prueba gratuita de esta vulnerabilidad contra su sistema, regístrese ahora.