Exploit PHPGedView 2.5/2.6 - 'Timeline.php' SQL Injection

[Exploiter]

EDB-ID

24837

Проверка EDB

1. Пройдено

Автор

JEIAR

Тип уязвимости

WEBAPPS

Платформа

PHP

CVE

cve-2004-0067

Дата публикации

2004-01-12

PHPGedView 2.5/2.6 - 'Timeline.php' SQL Injection

source: https://www.securityfocus.com/bid/11925/info

It is reported that PhpGedView is susceptible to a remote SQL injection vulnerability. This issue is due to a failure in the application to properly sanitize user-supplied input prior to including it in an SQL query.

This issue allows remote attackers to manipulate query logic. The issue could theoretically be exploited to compromise the software by performing unauthorized actions on the database, such as modifying or viewing data. SQL injection attacks may also be used to exploit latent vulnerabilities in the underlying database. This may depend on the nature of the query being manipulated as well as the capabilities of the database implementation.

This issue has been reported to effect PhpGedView 2.65beta5 and earlier.

http://www.example.com/phpgedview/timeline.php?pids=[Evil_Query]