Select local site

F-Secure Vulnerability Information :
AvailScript Article Script "aIDS" Cross-Site Scripting and SQL Injection
[Summary] | [Detailed Description] | [Solution] | [CVE Reference]

Report ID:SA31816
Source:Secunia
Date of Discovery:11.09.2008
Criticality:Moderate
Affects:

AvailScript Article Script
Compromise From:From remote
Compromise Type:Manipulation of data
Cross site scripting
Summary

Multiple vulnerabilities has been reported in AvailScript Article Script, which can be exploited by malicious people to conduct cross-site scripting and SQL injection attacks.
Back to the Top

Detailed Description

Multiple vulnerabilities has been reported in AvailScript Article Script, which can be exploited by malicious people to conduct cross-site scripting and SQL injection attacks.

1) Input passed to the "aIDS" parameter in articles.php is not properly sanitised before being returned to the user. This can be exploited to execute arbitrary HTML and script code in a user"s browser session in context of an affected site.

2) Input passed to the "aIDS" parameter in articles.php is not properly sanitised before being used in SQL queries. This can be exploited to manipulate SQL queries by injecting arbitrary SQL code.
Back to the Top

Solution

Filter malicious characters and character sequences using a proxy.
Back to the Top

CVE Reference
Back to the Top

F-Secure Corporation