PHP Script Index "search" SQL Injection and Cross Site Scripting Vulnerability

Technical Description

A vulnerability has been identified in PHP Script Index, which may be exploited by attackers to execute arbitrary SQL commands or scripting code. This flaw is due to an input validation error in the "search.php" script that does not validate the "search" parameter, which could be exploited by malicious people to conduct SQL injection and cross site scripting attacks.

Affected Products

PHP Script Index

Solution

The FrSIRT is not aware of any official supplied patch for this issue.

References

http://www.frsirt.com/english/advisories/2006/1158

Credits

Vulnerability reported by Preddy