Back to list
FAQMasterFlexPlus multiple vulnerabilities
Dec 28 2007 03:26AM
Juan Galiana (jgaliana gmail com)
- Security Advisory -
- FAQMasterFlexPlus multiple vulnerabilities -
Version: Latest version is affected, other not tested
Affected by: Cross-Site Scripting & SQL injection
FaqMasterFlexPlus is a free, database-driven web-based application
written in php for creating and maintaining
Frequently Asked Questions (FAQs) on your web site.
It has language support and features according documentation are:
"Allow to create unlimited categories and unlimited
Questions/Answers and has web-based category and FAQ administration
with Add, Edit, Delete Capability.",
It's free software, released under the GNU General Public Lisence (GPL).
Works with php & mysql and comes bundled in some versions of
Fantastico (Cpanel X).
Multiple flaws in FaqMasterFlexPlus have been discovered:
1) Cross Site Scripting:
The script faq.php suffers an XSS bug, specifically the variable
$cat_name it's not properly sanitized,
an attacker exploiting this flaw can perform an XSS attack to access
the targeted user cookies.
All Admin scripts to add/edit/delete categories and add/edit/delete
faq don't parse correctly the user supplied input too.
2) SQL Injection (to exploit this issue it's necesarry
magic_quotes_gpc set to Off in the php.ini file).
All the scripts suffers for sql injections attacks in the querys to
Then get a new line like this:
or a Proof of Concept to get the admin password:
Besides password is stored in plain text, this is a big security flaw.
This software is infected with many bugs and must be fully audited
for enforce the security.
08/05/2007 - Bugs discovered
10/05/2007 - Vendor Contact (No Response)
12/12/2007 - Vendor Contacted Again (No Response)
28/12/2007 - Advisory Disclosure
Juan Galiana <jgaliana gmail com>
[ reply ]
Copyright 2010, SecurityFocus