============ { Ariko-Security - Advisory #4/2/2010 } =============
SQL injection vulnerability in LiveChatNow
Vendor's Description of Software:
#demo
http://zebra.livechatnow.com/js/enter.php?cid=7546&skin=&survey=&survey_ec
=&survey_lm=&group=On-Duty+Techs
Dork:
#Powered by www.LiveChatNow.com
Application Info:
Vulnerability Info:
Time Table:
Input passed via the "cid" parameter to index.php (admim panel) is not
properly sanitised before being used in a SQL query.
Solution:
Vulnerability:
http://[site]/js/enter.php?cid=7546[SQLi]&skin=&survey=&survey_ec=&survey_
lm=&group=On-Duty+Techs
Credit:
Ariko-Security
Maciej Gojny
[email protected]
tel.: +48512946012 (Mo-Fr 10.00-20.00 CET)