Ravens PHP Scripts - The Classified Ad System default.asp Cross-Site Scripting and SQL Injection

SECUNIA ADVISORY ID: SA23289

VERIFY ADVISORY: http://secunia.com/advisories/23289/

CRITICAL: Moderately critical

IMPACT: Cross Site Scripting, Manipulation of data

SOFTWARE: The Classified Ad System - http://secunia.com/product/12857/

DESCRIPTION: Laurent Gaffié and Benjamin Mossé have reported some vulnerabilities in The Classifieds Ad System, which can be exploited by malicious people conduct SQL injection and cross-site scripting vulnerabilities.

1) Input passed to the "main" and "cat" parameter in default.asp is not properly sanitised before being used in a SQL query. This can be exploited to manipulate SQL queries by injecting arbitrary SQL code.

2) Input passed to the "main" and "cat" parameter in default.asp is not properly sanitised before being returned to a user. This can be exploited to execute arbitrary HTML and script code in a user's browser session in context of an affected site.

SOLUTION: Edit the source code to ensure that input is properly sanitised.

PROVIDED AND/OR DISCOVERED BY: Laurent Gaffié and Benjamin Mossé