The Reserve Logic Booking CMS is prone to multiple cross-site scripting vulnerabilities, a file upload vulnerability, multiple SQL-injection vulnerabilities, and multiple HTML-injection vulnerabilities because it fails to sufficiently sanitize user-supplied data.
Credit:
The original article can be found at: http://www.securityfocus.com/bid/54400 .
The information has been provided by Ibrahim El-Sayed,Benjamin Kunz Mejri .
Exploiting these issues could allow an attacker to upload and execute PHP arbitrary files, steal cookie-based authentication credentials, compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database.Reserve Logic Booking CMS 1.2 is vulnerable; other version may also be affecteded.
Vendor Status:
Currently we are not aware of any vendor-supplied patches
