PlanetCreator reported another critical SQL injection (vulnerability) on MyRingTune URL : http://www.myringtuneonline.com
SQL injection is a code injection technique that exploits a security vulnerability occurring in the database layer of an application. The vulnerability is present when user input is either incorrectly filtered for string literal escape characters embedded in SQL statements or user input is not strongly typed and thereby unexpectedly executed.
informed to :- webmaster
SQL
http://www.myringtune.com.mm/browse_artist.php?id=120
IP Address :- 74.52.89.82
Web Server :- Apache mod_fcgid/2.3.5 mod_auth_passthrough/2.1 mod_bwlimited/1.4 FrontPage/5.0.2.2635
Version :- 5.1.50
Database Name :- mytune_mrt
User :- mytune@localhost
At the same time, Security Researcher $@T0R! reported XSS vulnerability in above website.
XSS
Cross-site scripting (XSS) is a type of computer security vulnerability typically found in web applications that enables malicious attackers to inject client-side script into web pages viewed by other users.
http://www.myringtune.com.mm/artist.php?type=%22/%3E%3Cmarquee%20behavior=%22alternate%22%20direction=%22right%22%3E%3Cmarquee%20direction=%22up%22%20behavior=%22alternate%22%3EXSS%3C/marquee%3E%3C/marquee%3E
We hope that your security staff will look into this issue and fix it as soon as possible.