Executive brief
Ask Expert Script, a platform used for building Q&A and knowledge-sharing websites, contains security flaws that allow unauthorized individuals to interfere with the site. Attackers can use these vulnerabilities to steal sensitive information from the database or run malicious scripts in the browsers of site visitors. This could lead to the exposure of user data or the hijacking of administrative sessions without requiring any login credentials.
Technical details
Ask Expert Script 3.0.5 is vulnerable to both Cross-Site Scripting (XSS) and SQL Injection (SQLi) due to improper input sanitization of URL parameters. An unauthenticated remote attacker can exploit the XSS vulnerability by injecting script tags into the 'cateid' parameter of 'categorysearch.php', potentially leading to session hijacking or client-side code execution. Simultaneously, the 'view' parameter in 'list-details.php' is susceptible to SQL injection, allowing attackers to execute arbitrary SQL commands to extract sensitive data from the underlying database. These flaws can be exploited over the network without user interaction or prior authentication. While the vulnerabilities were discovered in version 3.0.5, users should contact the vendor for patch information as the software is marketed as open-source.
Affected products
- Phpscriptsmall Ask Expert Script 3.0.5
Timeline
- 2019-02-19: disclosed: Initial discovery and exploit proof-of-concept published by Mr Winst0n
- 2026-04-05: advisory: NVD/VulnCheck advisory published