dl_stats is prone to an SQL-injection vulnerability and multiple cross- site scripting vulnerabilities. Exploiting these issues could allow an attacker to steal cookie-based authentication credentials, control how the site is rendered to the user, compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database. dl_stats 2.0 is vulnerable other versions may also be affected.

• http://www.securityfocus.com/bid/39592
• http://www.xenuser.org/2010/04/18/dl_stats-multiple-vulnerabilities-sqli-xss-unprotected-admin-panel/
• http://www.xenuser.org/documents/security/dl_stats_multiple_vulnerabilities.txt

---

Updated on 2017-03-28