Secunia

Description
Some vulnerabilities have been discovered in Uiga Business Portal, which can be exploited by malicious people to conduct SQL injection and script insertion attacks.

1) Input passed via the "noentryid" parameter to blog/index.php (when "view" is set to "noentryid") is not properly sanitised before being used in SQL queries. This can be exploited to manipulate SQL queries by injecting arbitrary SQL code.

2) Input passed via the "p" parameter to index2.php (when "c" is set) is not properly sanitised before being used in SQL queries. This can be exploited to manipulate SQL queries by injecting arbitrary SQL code.

3) Input passed via the "textcomment" parameter to blog/index.php (when "view" is set to "noentryid" and "noentryid" is set) is not properly sanitised before being displayed to the user. This can be exploited to insert arbitrary HTML and script code, which will be executed in a user's browser session in context of an affected site when the malicious data is being viewed.

4) Input passed via the "id" parameter to index.php (when "view" is set to "photos") is not properly sanitised before being used in SQL queries. This can be exploited to manipulate SQL queries by injecting arbitrary SQL code.

The vulnerabilities are confirmed in the versions downloaded on February 8th 2010 and March 23rd 2010.

Solution
Edit the source code to ensure that input is properly sanitised.

Provided and/or discovered by
1 - 3) Sioma Labs
4) Easy Laster

Changelog
Further details available in Customer Area

Deep Links
Links available in Customer Area