:Khashayar Fereidani has reported some vulnerabilities in Maian Greetings, which can be exploited by malicious people to conduct cross-site scripting or SQL injection attacks.1) Input passed to the "keywords" parameter in index.php when the "cmd" parameter is set to "search" is not properly sanitised before being used in a SQL query. This can be exploited to manipulate SQL queries by injecting arbitrary SQL code.2) Input passed to the "msg_script" and "msc_script2" parameters in admin/inc/header.php is not properly sanitised before being returned to a user. This can be exploited to execute arbitrary HTML and script code in a user’s browser session in context of an affected site.The vulnerabilities are reported in version 2.1. Other versions may also be affected.Solution:Edit the source code to ensure that input is properly sanitised.Provided and/or discovered by:Khashayar Fereidani a.k.a. Dr.CrashOriginal Advisory:http://seclists.org/bugtraq/2008/May/0031.html

Original post by amit