Exploit phpBB 2.0.x - 'profile.php' SQL Injection

[Exploiter]

EDB-ID

23363

Проверка EDB

1. Пройдено

Автор

JOCANOR

Тип уязвимости

WEBAPPS

Платформа

PHP

CVE

null

Дата публикации

2003-11-08

source: https://www.securityfocus.com/bid/8994/info

A SQL injection vulnerability has been reported for phpBB systems.

phpBB, in some cases, does not sufficiently sanitize user-supplied input, which is used when constructing SQL queries to execute on the underlying database. As a result, it is possible to manipulate SQL queries. This may allow a remote attacker to modify query logic or potentially corrupt the database.

SQL injection attacks may also potentially be used to exploit latent vulnerabilities in the underlying database implementation.

http://www.example.com/profile.php?mode=viewprofile&u='[sqlcode]