News Script PHP v1.2 multiple defects and repair

Title: News Script PHP v1.2-Multiple Web Vulnerabilites
Impact System
7.5
 
Introduction:
==================
Visitors to your website will be able to read news, articles, interviews and stories which you have posted
Specific introduction can see here: http://www.newsscriptphp.com)
 
 
Abstract:
==========
News Script PHP v1.2 CMS multiple vulnerabilities discovered
Technical analysis:
==========
1.1
Multiple SQL Injection vulnerabilities are detected in the News Script PHP 1.2 Content Management System.
The vulnerability allows an attacker (remote) or local low privileged user account to inject/execute own
SQL commands on the affected application dbms without user inter action. Successful exploitation of
Vulnerability results in dbms & application compromise. The vulnerabilities are located in admin. php &
Preview. php file and bound values like orderBy & id.
 
Vulnerable File (s ):
[+] Preview. php
[+] Admin. php
 
Vulnerable Parameter (s ):
[+] Id
[+] OrderBy
 
 
1.2
Multiple non persistent cross site scripting vulnerabilities are detected in the News Script PHP 1.2 Content Management System.
The vulnerability allows remote attackers to hijack website customer, moderator or admin sessions with high required
User inter action or local low privileged user account. Successful exploitation can result in account steal, phishing
& Client-side content request manipulation. The vulnerabilities are located in the preview. php and admin. php files and
Bound values like search, ordertype, orderby & act.
 
Vulnerable File (s ):
[+] Preview. php
[+] Admin. php
 
Vulnerable Parameter (s ):
[+] Search
[+] OrderType
[+] OrderBy
[+] Act
 
 
Test proof:
========================
1.1
The SQL injection vulnerabilities can be exploited without required user inter action with privileged user account.
For demonstration or reproduce...
 
PoC:
Http: // MAID: 1338/news/preview. php? Id = [SQL-INJECTION]
Http://www.bkjia.com/news/preview. php? P = [SQL-INJECTION]
Http: // FIG: 1338/news/admin. php? Act = news & orderType = [ASC/DESC] & search = & orderBy = [SQL-INJECTION]
 
 
1.2
The non persistent input validation vulnerabilities can be exploited by remote attackers with medium or high required
User inter action & without privileged user account. For demonstration or reproduce...
 
PoC:
Http: // MAID: 1338/news/preview. php? Id = '14 & p = '& search = [cross site scripting]
Http: // FIG: 1338/news/admin. php? Act = news & orderType = '[cross site scripting]
Http://www.bkjia.com/news/admin. php? Act = news & orderType = [cross site scripting] & search = & orderBy = [cross site scripting]
Http: // MAID: 1338/news/preview. php? Act = news & orderType = [cross site scripting]
 
 
Risk:
=====
1.1
The security risk of the SQL injection vulnerabilities are estimated as hard
 
1.2
The security risk of the input validation vulnerabilities are estiamted as low (+)
 
VULNERABILITY RESEARCH LABORATORY TEAM
Web: www.vulnerability-lab.com
Mail: research@vulnerability-lab.com