Exploit vBSupport 2.0.0 Integrated Ticket System - 'vBSupport.php' SQL Injection

[Exploiter]

EDB-ID

30168

Проверка EDB

1. Пройдено

Автор

RUNVIRUS

Тип уязвимости

WEBAPPS

Платформа

PHP

CVE

cve-2007-3196

Дата публикации

2007-06-09

source: https://www.securityfocus.com/bid/24397/info

vBSupport is prone to an SQL-injection vulnerability because it fails to sufficiently sanitize user-supplied data before using it in an SQL query.

An attacker can exploit this issue by manipulating the SQL query logic to carry out unauthorized actions on the underlying database.

http://www.example.com/4/vBSupport.php?do=showticket&ticketid=[SQL]