Multiple cross-site scripting (XSS) vulnerabilities in SkaDate Dating allow remote attackers to inject arbitrary web script or HTML via the PATH_INFO to (1) admin/auth.php and (2) file_uploader.php.
CVSS 2.0
Severity: MEDIUM
Problem Type: CWE-79,
Products Affected
| Vendor | Product | Version |
|---|---|---|
| skadate | skadate_online_dating_software | 6.482 |
| skadate | skadate_online_dating_software | 6.0 |
| skadate | skadate_online_dating_software | 5.0 |
| skadate | skadate_online_dating_software | * |
Directory traversal vulnerability in index.php in SkaDate Dating allows remote attackers to read arbitrary files via a .. (dot dot) in the layout parameter.
CVSS 2.0
Severity: MEDIUM
Problem Type: CWE-22,
Products Affected
| Vendor | Product | Version |
|---|---|---|
| skadate | skadate_online_dating_software | 6.482 |
| skadate | skadate_online_dating_software | 6.0 |
| skadate | skadate_online_dating_software | 5.0 |
| skadate | skadate_online_dating_software | * |
PHP remote file inclusion vulnerability in index.php in SkaDate Dating allows remote attackers to execute arbitrary PHP code via a URL in the language_id parameter. NOTE: this can also be leveraged to include and execute arbitrary local files via directory traversal sequences.
CVSS 2.0
Severity: MEDIUM
Problem Type: CWE-94,
Products Affected
| Vendor | Product | Version |
|---|---|---|
| skadate | skadate_online_dating_software | * |