Some vulnerabilities have been discovered in SWTOR CharDB, which can be exploited by malicious people to conduct script insertion and SQL injection attacks.
1) Input passed via the "userun" POST parameter to user/registration.php is not properly sanitised before being used. This can be exploited to insert HTML and script code, which will be executed in a user's browser session in context of an affected site if malicious data is viewed.
2) Input passed via the "swtorun" POST parameter to user/login_check.php is not properly sanitised before being used in a SQL query. This can be exploited to manipulate SQL queries by injecting arbitrary SQL code.
3) Input passed via the "userun" POST parameter to user/registration.php is not properly sanitised before being used in a SQL query. This can be exploited to manipulate SQL queries by injecting arbitrary SQL code.
Successful exploitation of the vulnerabilities #2 and #3 requires that "magic_quotes_gpc" is disabled.
The vulnerabilities are confirmed in version 1.8b. Other versions may also be affected.
Vulnerable Products
Vulnerable Software: SWTOR CharDB 1.x
Solution
Edit the source code to ensure that input is properly sanitised.
