PlanetCreator reported another critical SQL injection (vulnerability) on MyRingTune  URL : http://www.myringtuneonline.com

SQL injection is a code injection technique that exploits a security vulnerability occurring in the database layer of an application. The vulnerability is present when user input is either incorrectly filtered for string literal escape characters embedded in SQL statements or user input is not strongly typed and thereby unexpectedly executed.

informed to :- webmaster

SQL

http://www.myringtune.com.mm/browse_artist.php?id=120

IP Address :- 74.52.89.82
Web Server :- Apache mod_fcgid/2.3.5 mod_auth_passthrough/2.1 mod_bwlimited/1.4 FrontPage/5.0.2.2635
Version :- 5.1.50
Database Name :- mytune_mrt
User :- mytune@localhost

At the same time, Security Researcher $@T0R! reported XSS vulnerability in above website.

XSS

Cross-site scripting (XSS) is a type of computer security vulnerability typically found in web applications that enables malicious attackers to inject client-side script into web pages viewed by other users.

http://www.myringtune.com.mm/artist.php?type=%22/%3E%3Cmarquee%20behavior=%22alternate%22%20direction=%22right%22%3E%3Cmarquee%20direction=%22up%22%20behavior=%22alternate%22%3EXSS%3C/marquee%3E%3C/marquee%3E

We hope that your security staff will look into this issue and fix it as soon as possible.