Summary
This host is running Cotonti and is prone to SQL Injection vulnerability.
Impact
Successful exploitation will allow an attacker to inject or manipulate SQL queries in the back-end database, allowing for the manipulation or disclosure of arbitrary data.
Solution
Upgrade to version 0.9.14 or higher,
For updates refer to http://www.cotonti.com
Insight
Input passed via the 'c' parameter to index.php (when 'e' is set to 'rss') is not properly sanitised before being used in a SQL query.
Affected
Cotonti version 0.9.13 and prior
Detection
Send a crafted sql query via HTTP GET request and check whether it is able to get the mysql version or not.
References
Severity
Classification
-
CVE CVE-2013-4789 -
CVSS Base Score: 7.5
AV:N/AC:L/Au:N/C:P/I:P/A:P
Related Vulnerabilities