Summary
This host is running Task Freak and is prone to Cross Site Scripting and SQL Injection vulnerabilities.
Impact
Successful exploitation will allow remote attackers to execute arbitrary HTML and script code and manipulate SQL queries by injecting arbitrary SQL code in a user's browser session in the context of an affected site.
Impact Level: Application.
Solution
Upgrade to the TaskFreak version 0.6.4 or later
For updates refer to http://www.taskfreak.com/download.php
Insight
The flaws are due to:
- Improper validation of user supplied input to 'tznMessage' parameter in 'logout.php'.
- Input passed via the 'password' parameter to 'login.php' (when username is set to a valid user), which is not properly sanitised before being used in a SQL query in 'include/classes/tzn_user.php'.
Affected
TaskFreak version prior to 0.6.4
References
Severity
Classification
-
CVE CVE-2010-1520, CVE-2010-1521 -
CVSS Base Score: 7.5
AV:N/AC:L/Au:N/C:P/I:P/A:P
Related Vulnerabilities