Summary
This host is running Horizon QCMS and is prone to multiple vulnerabilities.
Impact
Successful exploitation will allow remote attackers to execute SQL commands or obtain sensitive information.
Impact Level: Application
Solution
Upgrade to Horizon QCMS version 4.1 or later.
For updates refer to http://www.hnqcms.com/
A patch has been released, for more information refer below link http://sourceforge.net/projects/hnqcms/files/patches/
Insight
Flaw exists in 'd-load.php' and 'download.php' scripts, which fail to properly sanitize user-supplied input to 'category' and 'start' parameter
Affected
Horizon QCMS version 4.0, Other versions may also be affected.
Detection
Send a crafted exploit string via HTTP GET request and check whether it is able to read config file.
References
Updated on 2017-03-28
Severity
Classification
-
CVE CVE-2013-7138, CVE-2013-7139 -
CVSS Base Score: 7.5
AV:N/AC:L/Au:N/C:P/I:P/A:P
Related Vulnerabilities