JeiAr has reported multiple vulnerabilities in Metadot Portal Server, which can be exploited by malicious people to conduct cross-site scripting and SQL injection attacks.

Missing validation of input supplied in various parameters can be exploited to manipulate SQL queries by inserting arbitrary SQL code or to execute HTML and script code in users' browser sessions.

It is also possible to disclose various information about SQL queries and paths by supplying invalid input in parameters.

The vulnerabilities have been reported in version 5.6.5.4b5 and prior.

Solution
Update to version 5.6.6:
Further details available to Secunia VIM customers

Provided and/or discovered by
JeiAr, GulfTech Security Research Team.

Original Advisory
http://www.gulftech.org/01122004.php

Deep Links
Links available to Secunia VIM customers