PHPKit 1.6.1 RC2 (faq/faq.php) Remote SQL Injection Exploit

2007.01.11
Credit: yorn
Risk: Medium
Local: No
Remote: Yes
CWE: CWE-89


CVSS Base Score: 7.5/10
Impact Subscore: 6.4/10
Exploitability Subscore: 10/10
Exploit range: Remote
Attack complexity: Low
Authentication: No required
Confidentiality impact: Partial
Integrity impact: Partial
Availability impact: Partial

Pretty much the same, but for completeness... ;-) QL Injection in PHPkit 1.6.1 R2 ================================ Discovered on 09.01.2007 by yorn. Description: ------------ http://www.phpkit.de/ PHPkit is a php/sql based portal software. Problem: -------- SQL Injection: There are multiple SQL injections in PHPkit. Just check bugtraq. I think that this is a "new" one, so here we go: The "Gstebuch" is prone to a sql injection vulnerablility in comment.php. It is possible to gain access to the admin password hash: POC: comment.php&comcat=gb&subid=-1'%20UNION%20SELECT%201,1,1,1,1,1,user_pw,1 %20from%20PHPKIT_USER_TABLE%20where%20%20user_id=1/* Vendor Status: -------------- Vendor has been informed on the date of discovery. Not patched yet.


Vote for this issue:
50%
50%


 

Thanks for you vote!


 

Thanks for you comment!
Your message is in quarantine 48 hours.

Comment it here.


(*) - required fields.  
{{ x.nick }} | Date: {{ x.ux * 1000 | date:'yyyy-MM-dd' }} {{ x.ux * 1000 | date:'HH:mm' }} CET+1
{{ x.comment }}

Copyright 2020, cxsecurity.com

 

Back to Top