This host is running OSClass and is prone to multiple cross site scripting and SQL injection vulnerabilities.

Successful exploitation will allow attackers to execute arbitrary web script or HTML in a user's browser session in the context of an affected site and manipulate SQL queries by injecting arbitrary SQL code. Impact Level: Application

Upgrade to OSClass version 2.3.5 or later For updates refer to http://sourceforge.net/projects/osclass/files/

- Input passed via the 'sCategory' GET parameter to /index.php is not properly sanitised before being used in SQL query. - Input passed via the 'sCity', 'sPattern', 'sPriceMax', 'sPriceMin' GET parameters to /index.php is not properly sanitised before being returned to the user. - Input passed via the 'id' GET parameter in edit_category_post and enable_category action is not properly sanitised before being used in SQL query. - Input passed via the 'id' GET parameter in enable_category action to index.php is not properly sanitised before being returned to the user.

OSClass version prior to 2.3.5

• http://archives.neohapsis.com/archives/bugtraq/2012-01/0157.html
• http://osclass.org/blog/2012/01/16/osclass-2-3-5/
• http://secunia.com/advisories/47697
• http://www.codseq.it/advisories/multiple_vulnerabilities_in_osclass
• https://www.htbridge.com/advisory/HTB23068

---

Updated on 2015-03-25