This host is running evalSMSI and is prone to multiple vulnerabilities.

Successful exploitation will allow remote attackers to view, edit and delete the backend database via SQL Injection or inject arbitrary web script or HTML via cross-site scripting attack. Impact Level: Application

Upgrade to evalSMSI version 2.2.00 or later, For updates refer to http://sourceforge.net/projects/evalsmsi/files/

The multiple flaws are due to: - Input passed to the 'query' parameter in ajax.php (when 'question' action is set), 'return' parameter in ajax.php and while writing comments to assess.php page (when 'continue_assess' action is set) is not properly sanitised before being used in SQL queries. - The passwords are stored in plaintext in the database, which allows attackers with database access to gain privileges.

evalSMSI version prior to 2.2.00 on all platforms.

• http://packetstormsecurity.org/1002-exploits/corelan-10-008-evalmsi.txt
• http://secunia.com/advisories/38478
• http://xforce.iss.net/xforce/xfdb/56152
• http://xforce.iss.net/xforce/xfdb/56154
• http://xforce.iss.net/xforce/xfdb/56157

---

Updated on 2017-03-28