Cross-site scripting and SQL injection vulnerability in AContent

Release date:
Updated on:

Affected Systems:
Htbridge AContent 1.x
Description:
--------------------------------------------------------------------------------
Cve id: CVE-2012-5167, CVE-2012-5169

AContent is an e-learning content creation tool and library that supports the import, export, and production of IMS content packages.

Multiple vulnerabilities in AContent 1.2 and earlier versions can be exploited by malicious users to execute cross-site scripting and SQL injection attacks.

1) Input passed to file_manager/preview_top.php through the "pathext", "popup", "framed", "file" parameter is incorrectly filtered and is returned to the user, attackers can execute arbitrary HTML and script code in the user's browser.

2) The input passed to user/user_password.php through the "id" parameter, and the input passed to course_category/index_inline_editor_submit.php through the "field" parameter is used in SQL queries if it is not properly filtered, attackers can perform SQL queries.

<* Source: High-Tech Bridge

Link: http://secunia.com/advisories/51034/
Https://www.htbridge.com/advisory/HTB23117
*>

Suggestion:
--------------------------------------------------------------------------------
Vendor patch:

Htbridge
--------
Htbridge has released a Security Bulletin (HTB23117) and corresponding patches for this purpose:

HTB23117: Multiple vulnerabilities in AContent

Link: https://www.htbridge.com/advisory/HTB23117