Secunia

Some vulnerabilities have been reported in TurnkeyForms Text Link Sales, which can be exploited by malicious people to bypass certain security restrictions and by malicious users to conduct SQL injection attacks.

1) The application does not properly restrict access to the "admin.php" script. This can be exploited to gain administrative access to the application by requesting the script directly.

2) input passed to the "id" parameter in admin.php (when "a" is set to "users") is not properly sanitised before being used in SQL queries. This can be exploited to manipulate SQL queries by injecting arbitrary SQL code.

NOTE: This can further be exploited to execute arbitrary HTML and script code in a user's browser session via SQL error messages.

Solution
Restrict access to the admin area (e.g. via ".htaccess").
Further details available in Customer Area

Provided and/or discovered by
1) G4N0K
2) ZoRLu

Changelog
Further details available in Customer Area

Original Advisory
1) http://milw0rm.com/exploits/7118
2) http://milw0rm.com/exploits/7124

Deep Links
Links available in Customer Area