Parameter username is not properly sanitized. This can be used to post
arbitrary HTML or web script code. This code will be executed when
administrator will visit "Login Log" page.
Administrator's session is threatened.
2. PHP Code Insertion
Administrator has an ability to edit variables in ticker.db.php file.
Script dont make any sanitation of entered values. This can be used to
insert arbitrary PHP code.
System access is possible.
--------------PoC/Exploit----------------------
Available at: http://evuln.com/vulns/121/exploit.html
--------------Solution---------------------
No Patch available.
If you have additional information or notice any errors regarding this security advisory, please use contact form or email us at info()securityreason()com.