phpFaber TopSites <=2.0.9 - SQL Injection Vulnerability

2006-07-25 / 2006-07-26
Risk: Medium
Local: No
Remote: Yes
CWE: CWE-89


Ogólna skala CVSS: 7.5/10
Znaczenie: 6.4/10
Łatwość wykorzystania: 10/10
Wymagany dostęp: Zdalny
Złożoność ataku: Niska
Autoryzacja: Nie wymagana
Wpływ na poufność: Częściowy
Wpływ na integralność: Częściowy
Wpływ na dostępność: Częściowy

[MajorSecurity #21] phpFaber TopSites <=2.0.9 - SQL Injection Vulnerability ----------------------------------------------------------------- Software: phpFaber TopSites Version: <=2.0.9 Type: SQL Injection Vulnerability Made public: July, 19th 2006 Vendor: phpFaber, LLC Page: http://www.phpfaber.com/ Credits: ---------------------------------------------- Discovered by: David "Aesthetico" Vieira-Kurz http://www.majorsecurity.de Original Advisory: ---------------------------------------------- http://www.majorsecurity.de/advisory/major_rls21.txt Affected Products: ---------------------------------------------- phpFaber TopSites 2.0.9 and prior Description: ---------------------------------------------- phpFaber TopSites is a feature-packed, reliable and secure Top List for webmasters who want to increase traffic to their websites. It is fully customizable and doesn't require any programming skills! You can create your forms just in 3 clicks! Vulnerability: ---------------------------------------------- Input passed directly to the "i_cat" and "method" parameter in "index.php" is not properly sanitised before being used in a SQL query. This can be exploited to manipulate SQL queries by injecting arbitrary SQL code. Solution: ---------------------------------------------- Edit the source code to ensure that input is properly sanitised.


Vote for this issue:
50%
50%


 

Thanks for you vote!


 

Thanks for you comment!
Your message is in quarantine 48 hours.

Comment it here.


(*) - required fields.  
{{ x.nick }} | Date: {{ x.ux * 1000 | date:'yyyy-MM-dd' }} {{ x.ux * 1000 | date:'HH:mm' }} CET+1
{{ x.comment }}

Copyright 2024, cxsecurity.com

 

Back to Top