YEnH4ckEr has discovered some vulnerabilities in TemaTres, which can be exploited by malicious users to conduct SQL injection and script insertion attacks, and by malicious people to conduct SQL injection attacks.

1) Input passed to the "id_correo_electronico" and "id_password" parameters in login.php, to the "dcTema", "madsTema", "zthesTema", "skosTema", and "xtmTema" parameters in xml.php, and to the "letra" parameter in index.php is not properly sanitised before being used in SQL queries. This can be exploited to manipulate SQL queries by injecting arbitrary SQL code.

Successful exploitation requires that "magic_quotes_gpc" is disabled.

2) Input passed to the "y" and "m" parameters in index.php is not properly sanitised before being used in SQL queries. This can be exploited to manipulate SQL queries by injecting arbitrary SQL code.

Successful exploitation requires valid user credentials and that "magic_quotes_gpc" is disabled.

3) Input passed to the application when editing a term is not properly sanitised before being used. This can be exploited to insert arbitrary HTML and script code, which will be executed in a user's browser session in context of an affected site when the malicious data is displayed.

The vulnerabilities are confirmed in version 1.03. Other versions may also be affected.

Solution
Update to version 1.031.

Provided and/or discovered by
YEnH4ckEr

Changelog
Further details available to Secunia VIM customers

Original Advisory
http://milw0rm.com/exploits/8615
http://milw0rm.com/exploits/8616

Deep Links
Links available to Secunia VIM customers