PHP Scripts Now Riddles - '/riddles/results.php?searchQuery' Cross-Site Scripting

EDB-ID:

34902

CVE:

2009-2890

EDB Verified:

Author:

Moudi

Type:

webapps

Exploit: /

Platform:

PHP

Date:

2009-08-20

Vulnerable App:

Become a Certified Penetration Tester

Enroll in Advanced Web Attacks and Exploitation , the course required to become an Offensive Security Web Expert (OSWE)

GET CERTIFIED

source: https://www.securityfocus.com/bid/44309/info

PHP Scripts Now Riddles is prone to an SQL-injection vulnerability and a cross-site scripting vulnerability because it fails to sufficiently sanitize user-supplied data.

Exploiting these issues could allow an attacker to steal cookie-based authentication credentials, compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database.

http://www.example.com/results.php?searchquery=1<script>alert(308297104532)</script>&search=Search

Tags:

Advisory/Source: Link

Downloads	Certifications	Training	Professional Services
Kali Linux	OSCP	Penetration Testing with Kali Linux (PWK)	Penetration Testing
Kali NetHunter	OSWP	Advanced Web Attacks and Exploitation (AWAE)	Advanced Attack Simulation
Kali Linux Revealed Book	OSCE	Offensive Security Wireless Attacks (WiFu)	Application Security Assessment
	OSEE	Cracking the Perimeter (CTP)
	OSWE	Metasploit Unleashed (MSFU)
	KLCP	Free Kali Linux Training