|
Description
|
|
Multiple vulnerabilities have been identified in HotPlug CMS, which could be exploited by remote attackers to execute arbitrary SQL commands or malicious scripting code.
The first flaw is due to an input validation error in the "authenticate()" [administration/includes/login/auth.php] function that does not validate the "username" and "password" parameters before being used in SQL statements, which could be exploited by malicious people to conduct SQL injection attacks and gain unauthorized administrative access to a vulnerable application (i.e. via the "administration/tblcontent/login1.php" script).
The second flaw is due to an input validation error in the "administration/tblcontent/login1.php" script that does not validate the "msg" parameter, which could be exploited by attackers to cause arbitrary scripting code to be executed by the user's browser in the security context of an affected Web site.
|
