Facebook Google Plus Twitter LinkedIn YouTube RSS Menu Search Resource - BlogResource - WebinarResource - ReportResource - Eventicons_066 icons_067icons_068icons_069icons_070

paFileDB < 3.2 XSS and SQL Injection Vulnerabilities

Medium

Synopsis

The remote web server contains a script that is vulnerable to a SQL injection attack.

Description

PHP Arena paFileDB is a web application that is used to manage files. This version of paFileDB is vulnerable to a remote cross-site-scripting (XSS) flaw. Exploiting the flaw may enable an attacker to inject arbitrary script code into the browser of unsuspecting users. A successful attack would potentially allow the attacker the ability to view confidential data (cookies, authentication data, and more) or compromise the integrity of the local system via the web browser. The version of paFileDB is also vulnerable to a remote SQL injection attack. An attacker exploiting this flaw would only need to be able to send a query to the 'viewall.php' or 'category.php' script. A successful exploit would give the attacker the ability to read or write confidential data as well as potentially execute arbitrary commands on the remote web server.

Solution

Upgrade to version 3.2 or higher.