Exploit PHPGedView 2.5/2.6 - 'Placelist.php' SQL Injection

Exploiter

Хакер
34,644
0
18 Дек 2022
EDB-ID
24835
Проверка EDB
  1. Пройдено
Автор
JEIAR
Тип уязвимости
WEBAPPS
Платформа
PHP
CVE
cve-2004-0067
Дата публикации
2004-01-12
PHPGedView 2.5/2.6 - 'Placelist.php' SQL Injection
Код:
source: https://www.securityfocus.com/bid/11910/info

It is reported that PhpGedView is susceptible to a remote SQL injection vulnerability. This issue is due to a failure in the application to properly sanitize user-supplied input prior to including it in an SQL query.

This issue allows remote attackers to manipulate query logic, leading to unauthorized access and the disclosure of potentially sensitive information. The issue also allows the possible corruption of database data leading to a loss of integrity. SQL injection attacks may also be used to exploit latent vulnerabilities in the underlying database.

This issue has been reported to effect PhpGedView 2.65beta5 and earlier.

http://www.example.com/phpgedview/placelist.php?level=1[Evil_Query]
http://www.example.com/phpgedview/placelist.php?level=1&parent[0]=[Evil_Query]
http://www.example.com/phpgedview/placelist.php?level=2&parent[0]=&parent[1]=[Evil_Query]
 
Источник
www.exploit-db.com

Похожие темы