Description
SQL injection and cross-site scripting (XSS) vulnerabilities exist in EasyE-Cards. Input parameters are not properly validated before database operations and HTML output generation.
Impact
SQL injection allows attackers to extract sensitive data from the database. XSS enables session hijacking and potential defacement of the e-card service.
Solution
Apply parameterized queries and HTML output encoding. Contact the vendor for patches.