CVE-2011-5177

Name of the Vulnerable Software and Affected Versions eSyndiCat Pro version 2.3.05

Description The issue allows remote attackers to inject arbitrary web script or HTML via specific parameters, including the id parameter to various admin pages, such as admins, blocks, articles, or suggest-category, and the sort parameter to the search page.

Recommendations For eSyndiCat Pro version 2.3.05, consider restricting access to the admin/controller.php file until a patch is available, and avoid using the id parameter in the admins, blocks, articles, or suggest-category pages, as well as the sort parameter in the search page.