Cyb3r-1sT has reported some vulnerabilities in Social Groupie, which can be exploited by malicious users to conduct SQL injection attacks and compromise a vulnerable system.

1) Input passed to the "id" parameter in group_index.php is not properly sanitised before being used in SQL queries. This can be exploited to manipulate SQL queries by injecting arbitrary SQL code.

2) The application fails to validate the types of uploaded images. This can be exploited to upload files with arbitrary extensions (e.g. ".php") and execute arbitrary PHP code on the server.

Solution
Filter malicious characters and character sequences using a proxy.
Further details available in Customer Area

Provided and/or discovered by
Cyb3r-1sT

Changelog
Further details available in Customer Area

Original Advisory
1) http://milw0rm.com/exploits/7433
2) http://milw0rm.com/exploits/7435

Deep Links
Links available in Customer Area